Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,030 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects the execution of specific file names used as fake installers for the OnyxC2 stealer, which are typically delivered in password-protected archives.
Detects WMI interactions targeting the MSFT_NetQosPolicySettingData class within the ROOT\StandardCimv2 namespace. The EDRChoker tool abuses this specific WMI class to silently drop EDR telemetry by limiting bandwidth to unworkable speeds (e.g., 8 bits per second), bypassing standard WFP tampering alerts.
Detects the creation or modification of a local VSCode workspace extension (package.json) that maps a keybinding to the 'workbench.extensions.installExtension' command while explicitly setting 'skipPublisherTrust' to true. This technique is used to bypass VSCode's publisher trust mechanisms and silently install malicious extensions.
Detects the execution of 'userscreen.exe', which is the masqueraded name used for 'pythonw.exe' by APT37's NarwhalRAT. This defense evasion technique hides the Python console window and blends in with legitimate system processes before loading its fileless payload into memory.
Detects the use of the New-NetQosPolicy PowerShell cmdlet with parameters designed to aggressively throttle application bandwidth. Attackers can utilize this technique to restrict EDR agent bandwidth to near zero, causing server timeouts while avoiding explicit process termination and bypassing standard WFP tampering alerts.
SniperDz VAPID Key Activity
Cortex XDR
Detects web requests or command line activity containing the specific VAPID public key associated with the SniperDz push-notification infrastructure. This key is known to be used by the SniperDz PhaaS (Phishing-as-a-Service) ecosystem.
Detects network connections or DNS queries to the specific link-aggregation domain 'fanlnk.to'. This domain is known to be abused by the threat actor SniperDz to mask the destination of malicious social media lures, often leading to phishing or malware delivery.
Detects the creation of a scheduled task used by NarwhalRAT for persistence, using a specific task name and execution pattern. The rule looks for 'schtasks.exe' being executed with '/create' or '-create' flags and the unique task name 'MicrosoftUserInterfacePicturesUpdateTackMachine'. It covers process creation events from DeviceProcessEvents, SecurityEvent (EventID 4688), and Sysmon (EventID 1).
Detects the execution of an executable from the temporary ScreenConnect application directory. This behavior has been observed in recent malvertising campaigns where rogue ScreenConnect instances are used to deploy and execute multi-stage crypters (e.g., FatMalloc/crypteds.exe) from this directory, initiating ransomware and BYOVD payloads.
Detects the loading of 'borlndmm.dll' from unusual directories, an activity associated with OnyxC2 stealer DLL side-loading techniques, where the malicious DLL is typically inflated via binary padding to evade detection.
Page 226 of 249