Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,030 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects StealC infostealer post-execution self-deletion. The rule identifies instances where cmd.exe is launched by a non-shell process to forcefully delete an executable file located within TEMP or APPDATA directories, a common TTP used by malware to remove forensic artifacts after data exfiltration.
Detects attempts to bypass User Account Control (UAC) by spawning processes from fodhelper.exe, eventvwr.exe, or computerdefaults.exe. These executables are known to be vulnerable to UAC bypass techniques, allowing an attacker to elevate privileges without user interaction.
Detects PowerShell-based malware stagers used by ErrTraffic ClickFix campaigns that download and execute second-stage payloads using encoded commands and common download cradles. It also detects certutil.exe used for decoding.
Detects the use of wbadmin.exe to initiate a system backup that targets sensitive Active Directory and registry files (NTDS.dit, SYSTEM, and SECURITY hives) to a local SMB share on the loopback address. This technique is used by threat actors to stage critical credential material for offline extraction and cracking.
Detects remote SMB access (Event ID 5145) to sensitive file paths where credentials are commonly stored, including DPAPI master keys, browser profiles, cloud provider configuration directories, and password manager data. This activity often indicates unauthorized credential discovery and staging during lateral movement or post-compromise reconnaissance.
Detects the installation of RustDesk as a Windows service, identified via System event log ID 7045. Adversaries may abuse this remote access tool to maintain persistent, unauthorized remote access to compromised systems, as observed in ransomware intrusions.
Detects malicious msimg32.dll files associated with the Bumblebee loader by identifying unique, randomized, dictionary-derived strings within the PE file version resource metadata. These strings serve as a known signature for Bumblebee builders, often used to trojanize MSI installers.
This rule detects outbound network traffic from internal hosts to a known malicious IP address (193.242.184.150) over port 22 (SSH). This behavior is indicative of a reverse SSH tunnel established for C2 communication and the potential exposure of internal RDP services to the attacker.
This rule identifies the execution or presence of a specific malicious installer executable (MD5 87603EA025623B19954E460ADD532048) that is known to be reused and renamed across multiple campaigns to masquerade as legitimate software installers.
Detects instances where a process named 'install.exe' loads a DLL named 'install.res.1033.dll' from the same directory. This pattern is often associated with software installers or potential masquerading attempts where malicious payloads utilize specific resource DLL naming conventions.
Page 220 of 249