Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,030 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
SniperDz Domain IOCs
Cortex XDR
Detects network connections or DNS queries to known domain names associated with the SniperDz core monetization and redirection infrastructure. This rule specifically looks for traffic to 'win.feezossl.xyz', 'win.anababayala.com', 'aff.bnaosf1he.shop', and 'offer.raviral.com' in DNS query names or HTTP network metadata.
Detects the execution of the Windows built-in 'tar' utility to extract files into the specific public 'AccountPictures' directory. This behavior is indicative of the setup phase of APT37's NarwhalRAT.
Detects successful or anomalous authentications utilizing the Microsoft device code flow. Kali365 and other phishing-as-a-service platforms actively abuse this flow to register attacker devices, bypassing multi-factor authentication (MFA) and gaining unauthorized access to Microsoft 365 environments.
Identifies network connections to specific IP addresses known to be part of the SniperDz phishing and subscription fraud ecosystem. These IPs are hosted on Horizon IQ and are associated with hundreds of suspicious domains.
Detects incoming emails containing hyperlinks to legitimate Microsoft device code authentication pages combined with keywords or spoofed branding for document sharing services like DocuSign, Adobe Acrobat Sign, or SharePoint. This technique is indicative of Kali365 and similar Phishing-as-a-Service (PhaaS) kits attempting to steal OAuth tokens and bypass MFA.
Detects Node.js executing the 'utils.cjs' script, which serves as the obfuscated malware dropper for a North Korean-linked infostealer campaign. This script is typically triggered by a malicious npm postinstall hook to download the second-stage payload.
Detects HTTP POST requests directed to the specific URI path '/api/validate/keyboard-events', which is used by a North Korean-linked npm malware to exfiltrate keylogger data.
Bun Runtime Remote Download
Cortex XDR
Detects network connections downloading the Bun runtime from the oven-sh GitHub repository, a behavior exhibited by the Hades loader. This rule specifically looks for HTTP network events where the URL contains 'github.com' and 'oven-sh/bun/releases/download', indicating an attempt to download the Bun runtime.
Detects the creation of specific AI assistant configuration files (e.g., Cursor, Claude, Gemini, VS Code) by alternative runtimes. The Miasma malware targets modern AI coding assistants to inject hidden backdoors that trigger automatically when projects are opened.
Page 227 of 249