Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,030 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects the execution of Chrome Remote Desktop (remoting_host.exe) with daemon flags, which NightSpire ransomware operators use to establish persistence.
Detects C2 beaconing and token validation activity via GitHub API commit searches using the exact strings hardcoded in the Miasma payload. The worm uses these searches to validate connectivity and verify stolen token legitimacy.
ClickFix Payload Domain Network Traffic
Cortex XDR
Detects network connections or DNS queries to colafunfacts.net, a domain known to host malicious droppers disguised as logs and browser zip files in ClickFix campaigns.
Detects specific file artifacts associated with the ClickFix RAT that disguise Python executables or bytecode as standard image files (e.g., mev.png, USO.ico, USO.png) to evade detection.
Payload Ransomware Execution Flags
Cortex XDR
Detects the execution of a process using specific command-line flags associated with Payload ransomware's anti-forensic capabilities (e.g., --bypass-etw, -li).
Detects wscript.exe initiating outbound network connections to non-standard HTTP ports (ports other than 80, 443, or 8080), which aligns with JS.MonoGlyphRAT's C2 communication profile.
Detects the execution of cURL commands downloading an MSI installer and passing it to msiexec for silent installation, matching UNC3753's SuperOps RMM staging tactic.
cURL MSI Download and Execution
Cortex XDR
Detects the execution of cURL commands chained with msiexec to download and silently install an MSI package, a known tactic used by UNC3753 to deploy RMM tools like SuperOps.
Detects Atlas RAT performing anti-analysis and sandbox evasion checks by querying the Windows Defender Application Guard (WDAG) RunOnce registry key. This behavior is associated with TA4922.
Detects the anomalous download of the Bun JavaScript runtime during npm/node-gyp installation phases. The Miasma malware uses a standalone Bun runtime to execute its obfuscated payloads outside of standard Node.js security tooling contexts to evade monitoring.
Page 229 of 249