Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,030 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects HTTP response bodies containing specific strings associated with the 'Montana Empire' phishing kit. This rule monitors for indicators that a web server is serving a phishing credential harvesting page.
Detects the Montana Empire Android malware, either through a direct SHA256 hash match or through structural characteristics of the APK file (such as the presence of 'post.apk') combined with specific embedded strings commonly found in the attacker's fraudulent mobile landing pages used for social proof.
Detects outbound HTTPS traffic from a web server to api.telegram.org. This pattern is indicative of the Montana Empire phishing kit using the Telegram Bot API for command and control (C2) communication, allowing the adversary to exfiltrate stolen data or receive instructions.
Detects PowerShell script used to extract hidden payloads from BMP image files via RGB pixel channel parsing, as observed in multi-stage Remcos RAT loader campaign. This technique is often used to conceal malicious code within seemingly innocuous image files.
This rule detects suspicious process creation events where a process is spawned from common user-writable directories (AppData\Roaming, AppData\Local\Temp, Desktop) and subsequently allocates memory with characteristics often associated with code injection or execution (VirtualAlloc, NtAllocateVirtualMemory, PAGE_EXECUTE_READWRITE, 0x40). It filters out known legitimate Windows processes that might exhibit similar behavior.
This rule detects attempts by non-browser processes to access sensitive files that commonly contain credentials, such as browser login data (Chrome, Firefox) or the Windows Security Account Manager (SAM) database. This activity could indicate credential dumping or information theft.
This rule detects outbound network connections from the internal network to external hosts on specific ports (2404, 37393) that are known to be used by the Remcos Remote Access Trojan (RAT) for command and control (C2) communications. The rule is designed to identify established TCP connections to the server.
Detects suspicious child processes spawned in a suspended state, indicative of process hollowing. The rule specifically targets legitimate Windows system processes (svchost.exe, explorer.exe, rundll32.exe, dllhost.exe, taskhost.exe, taskhostw.exe, msiexec.exe, regsvr32.exe) when they are spawned by non-system parent processes originating from user-writable paths like AppData, Temp, Roaming, ProgramData, or Desktop. This behavior is commonly associated with malware like Remcos RAT.
Detects the LokiBot information stealer establishing persistence via a Windows Run key. The detection looks for registry key modifications under HKCU that follow a specific pattern: the registry value points to an executable located within the %APPDATA% directory inside a short, six-character hexadecimal subdirectory. The rule further validates this behavior by monitoring for key names derived from the C2 infrastructure components, such as IP addresses or specific PHP script names, commonly observed in builder-generated LokiBot samples.
Detects the final payload stage of LokiBot infostealer, characterized by a 32-bit Windows PE file built with MSVC 2015. The rule identifies specific known malicious file hashes or a structural signature featuring a non-standard PE section named 'x', which is used by the malware to store 3DES-encrypted C2 endpoint addresses.
Page 222 of 249