Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,030 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects DNS requests to domains matching known UNC3753 data leak sites or phishing domains masquerading as IT helpdesks, serving as an early warning of an ongoing vishing campaign or active extortion.
Detects the execution of Windows 365 native clients (Windows365.exe). Threat actors like UNC3753 abuse legitimate VDI clients on compromised BYOD devices to bypass corporate perimeters and access sensitive internal network segments.
Detects network connections or web proxy requests to malicious domains (such as colafunfacts.net) known to host initial droppers, decoy pages, and payload archives for the ClickFix RAT campaigns.
Detects HTTP/DNS network traffic attempting to download the Bun runtime from the specific GitHub releases path. This behavior is exhibited by the malicious Python loader in the Hades PyPI supply chain attack to stage its execution environment.
Explorer File Visibility Downgrade
Cortex XDR
Detects modifications to Windows Explorer registry keys (Hidden, ShowSuperHidden, HideFileExt) to conceal files. This technique is often used by malware, such as GammaWorm, as a defense evasion mechanism to hide malicious artifacts from users and security tools. The rule specifically looks for changes to the 'Advanced' registry key path within 'Software\Microsoft\Windows\CurrentVersion\Explorer' that would result in files or file extensions being hidden.
Detects network connections to Hugging Face domains initiated by Node.js. This behavior is associated with a North Korean-linked npm infostealer campaign that abuses the legitimate AI/ML platform to host its second-stage payload and receive exfiltrated stolen data archives, bypassing standard reputation-based network filtering.
Detects the creation of a scheduled task intended to execute a VBScript (.vbs). This technique is notably used by a North Korean-linked npm infostealer RAT to establish login persistence via a hidden VBS launcher.
Detects the execution of the initial fingerprinting PowerShell script utilized by the PhantomRelay RAT. PhantomRelay is a custom Remote Access Trojan associated with the Russia-nexus threat group GREYVIBE. The script gathers system information such as computer name, username, and PID, using a hardcoded User-Agent string before connecting to the C2 server.
Detects unusual network traffic over TCP port 886, which is specifically used by Atlas RAT for command and control check-ins and encrypted data exfiltration in recently observed TA4922 campaigns.
Detects the execution of cURL commands downloading an MSI installer and passing it to msiexec for silent installation, matching UNC3753's SuperOps RMM staging tactic.
Page 230 of 249