Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,030 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
This rule detects infostealer activity involving desktop screenshot capture and clipboard monitoring, which are common tactics used by the StealC infostealer family to harvest sensitive information. The detection triggers when known StealC binaries execute or when native Windows utilities like the Snipping Tool or PSR are launched by suspicious parent processes associated with this malware.
Detects the LokiBot malware attempting to resolve the 'CreateMutexW' API function at runtime using a specific hashed value (0xcf167df4). This technique is used by the malware to prevent multiple concurrent instances from running on the same host, which is a characteristic behavioral pattern for this information stealer.
Detects wscript.exe executing PowerShell to run a script dropped into the C:\Temp directory. This behavior is consistent with common JScript dropper infection chains, such as Amadey or StealC, which use WScript to decode and execute Base64 payloads from temporary files using hidden windows and bypassed execution policies.
Detects outbound network connections from the aspnet_compiler.exe process. This process is often abused by malware like LokiBot as a host for malicious payloads through process injection to establish C2 communication, as it has no legitimate need for external network connectivity.
Detects the use of reflective .NET assembly loading in PowerShell script blocks. This technique, commonly utilized by the LokiBot information stealer, allows attackers to load and execute malicious .NET payloads directly in memory, bypassing the need to write files to disk.
Detects instances where a process executing from a user-writable directory (e.g., Temp, AppData) reads the HKLM\SOFTWARE\Microsoft\Cryptography\MachineGuid registry key. This behavior is a known technique utilized by the LokiBot information stealer to derive a host-specific mutex for tracking infections.
Detects PNG or BMP image files used as steganographic carriers for hidden PE payloads. This rule specifically looks for PE (Portable Executable) headers (MZ and PE signatures) either appended after the PNG IEND (End of Image) marker or embedded within a high-entropy BMP file, indicating a hidden executable payload. This technique has been observed in multi-stage Remcos RAT loader campaigns.
Detects the creation or modification of a file named 'logs.dat' within the 'AppData\Roaming\DT\' directory by processes other than 'explorer.exe' or 'system'. This pattern is often indicative of malware or unwanted programs attempting to establish persistence or store data in a hidden or less scrutinized location.
This rule detects registry activity that indicates the presence of a virtualization or sandbox environment. Malware often checks for such environments to evade analysis. The rule specifically looks for registry keys and values associated with VMware and VirtualBox.
This rule detects suspicious process activity where common scripting or Office applications (PowerShell, WScript, CScript, MSHTA, Regsvr32, Word, Excel, Outlook) are either executing commands containing 'VirtualAlloc' (indicative of process injection techniques) or are themselves the target of such commands. This combination suggests an attempt to execute malicious code, potentially in-memory, leveraging legitimate applications.
Page 223 of 249