Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,030 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects the execution of financial-themed executable files (masquerading as .com or .scr) that are launched directly from common email client processes. This rule aims to identify phishing attempts where users are tricked into opening malicious attachments disguised with financial keywords.
Detects browser connections to the Bing Search by Image endpoint, which can be exploited as a Server-Side Request Forgery (SSRF) proxy to bypass Content Security Policies (CSP) and exfiltrate data, as seen in the SearchLeak attack. The rule specifically looks for connections to 'bing.com/images/searchbyimage' that also include the 'imgurl=' or 'imgurl%3d' parameter, indicating an attempt to use the server-side fetch functionality.
Detects the use of the PostgreSQL client utility (psql.exe) to directly query the VeeamBackup database for credential information. This behavior is indicative of unauthorized attempts to extract encrypted backup credentials, which may be subsequently decrypted using DPAPI.
Detects DNS queries for 14-character alphanumeric .org domains characteristic of Bumblebee malware's Domain Generation Algorithm (DGA).
Detects outbound HTTP requests exhibiting a User-Agent string hardcoded to mimic Firefox 20.0 (Mozilla/5.0 (Windows NT 6.2; rv:20.0) Gecko/20121202 Firefox/20.0), which is characteristic of the Adaptix C2 framework. This pattern is commonly used by adversaries for command-and-control communication.
Detects the Bumblebee loader technique where a trojanized installer drops the legitimate Windows binary consent.exe and a malicious msimg32.dll into a temporary directory. The rule flags instances where consent.exe loads msimg32.dll from an AppData subfolder, indicating a DLL search order hijacking attempt rather than loading the trusted system library.
Detects modifications to the 'LimitBlankPasswordUse' registry setting to '0'. This modification enables remote network logons for accounts with blank passwords, a technique abused by threat actors like DragonForce for persistence.
Detects the creation or loading of a driver named Havoc.sys in a temporary directory, or the loading of a known vulnerable Huawei audio driver (HWAuidoOs2Ec.sys) identified by its SHA256 hash. This activity is indicative of the Havoc Process Terminator BYOVD tool, often used in recent campaigns to blind EDR solutions.
Detects modifications to the 'Run' registry key that include suspicious command-line arguments often used by malware for persistence and evasion. Specifically looks for '-ExecutionPolicy Bypass', '-WindowStyle Hidden', or references to 'AppData\Local\Temp' in the registry data.
This rule detects instances where common Microsoft Office applications (Word, Excel, PowerPoint, Outlook, Publisher, Access, OneNote) spawn scripting or command interpreter processes such as PowerShell, WScript, CScript, Mshta, Regsvr32, or Cmd.exe. This behavior is often indicative of malicious activity, such as macro-enabled malware executing payloads or exploiting vulnerabilities.
Page 224 of 249