Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,030 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects potential session replay attacks indicative of Kali365 and other AitM (Adversary-in-the-Middle) proxying phishing kits. This rule isolates successful user logins containing a SessionId. To fully operationalize this for AitM detection, defenders must utilize SIEM-based correlation (e.g., statistical or window-based queries) to track a single SessionId originating from multiple geographically disparate IP addresses within a short timeframe.
Payload Ransomware File Artifacts
Cortex XDR
Detects the creation of files with the .payload extension or the RECOVER_payload.txt ransom note, indicating active encryption by Payload ransomware.
Detects the execution of WinSCP or Rclone binaries, which are frequently used by threat actors like UNC3753 to exfiltrate staged data. This rule specifically looks for process creation events where the image name is 'winscp.exe' or 'rclone.exe'.
Detects the creation or execution of specific file artifacts associated with the ClickFix RAT that disguise Python executables or bytecode as standard image files to evade detection. The rule specifically looks for file names 'mev.png', 'uso.ico', or 'uso.png' in file or process events.
Hades Bun Payload Execution
Cortex XDR
Detects the execution of the Bun runtime passing '_index.js' as a target, matching the Hades PyPI campaign loader behavior. This indicates potential malicious activity associated with the Hades PyPI campaign.
Detects the anomalous download of the Bun JavaScript runtime during npm/node-gyp installation phases. The Miasma malware uses a standalone Bun runtime to execute its obfuscated payloads outside of standard Node.js security tooling contexts to evade monitoring.
Curl Download From Telegram Channel
Cortex XDR
Detects the use of curl.exe to download files from public Telegram channels to the user's Temp directory, indicative of Gamaredon Dead Drop Resolver (DDR) resolution.
Detects the initial execution phase of the Phantom Gyp technique where a node-gyp rebuild command is abused to execute a silent payload and return a fake C stub file. This behavior is associated with the Miasma npm supply chain attack.
ClickFix RAT C2 Connection
Cortex XDR
Detects network traffic to the primary command and control (C2) IP address (104.207.131.216) over port 16443, which is used by the ClickFix Python Remote Access Trojan (RAT) for malicious communication.
Detects the execution of Chrome Remote Desktop (remoting_host.exe) with daemon flags, which NightSpire ransomware operators use to establish persistence.
Page 228 of 249