Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,030 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects HTTP network connections to the specific URI path and parameters used by the OnyxC2 stealer for C2 beaconing and data exfiltration.
Detects DbgView.exe, DbgView64.exe, or VirtualBox.exe processes making unexpected outbound network connections to public IP addresses. This behavior is associated with Backdoor.Turn, which is known to inject into these trusted processes via DLL sideloading to communicate with C2 servers, potentially routing traffic through Microsoft Teams TURN relays.
Detects LSASS credential dumping using comsvcs.dll via rundll32, specifically looking for the ordinal 24 or the string "MiniDump" in the command line. This technique is commonly used by attackers for credential harvesting, especially after bypassing EDR solutions.
Detects the VSCode executable making direct web requests to the GitHub API. This may indicate a malicious extension exfiltrating or validating stolen OAuth tokens, as demonstrated in the 1-click GitHub Dev/VSCode webview attack.
This rule detects unusual parent-child process relationships for 'svchost.exe' and 'explorer.exe'. Specifically, it flags instances where 'svchost.exe' is spawned by a process other than 'services.exe', 'msiexec.exe', or another 'svchost.exe' instance. It also flags 'explorer.exe' being spawned by a process other than 'userinit.exe' or another 'explorer.exe' instance. These relationships can indicate process injection, masquerading, or other forms of malicious activity.
Detects the specific xcopy command-line arguments used by APT37 NarwhalRAT to silently copy data from removable drives to a local temporary path. This rule looks for the combination of '/s', '/e', '/y', '/c', '/q', '/h', and '/b' flags used with xcopy.exe, which is indicative of the malware's data staging behavior.
Detects the use of curl.exe to download the Python embeddable zip file directly into the C:\Users\Public directory, which is indicative of NarwhalRAT staging activity.
Detects modifications to the .vscode/extensions.json file which may be used by attackers to recommend malicious extensions to victims opening the workspace. Attackers can abuse this in conjunction with automated keystrokes to bypass warnings and force extension installations.
Detects a Python runtime (such as userscreen.exe or python.exe) executing a file with a .cat extension. This technique is used by APT37 NarwhalRAT to conceal Python bytecode payloads.
Page 225 of 249