Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,030 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects DNS queries to privnote.com, which UNC3753 uses to transmit self-destructing text containing malicious installation links to targets.
Privnote DNS Resolution
Cortex XDR
Identifies endpoints resolving privnote.com, a self-destructing message service abused by UNC3753 to transmit malicious installation links while bypassing chat and email filtering.
cURL Request to Raw IP for Installer
Cortex XDR
Detects cURL making direct HTTP requests to raw IPv4 addresses specifically seeking 'installer' binaries. This staging pattern is utilized by UNC3753 to deploy RMM payloads on victim machines.
Detects the execution of the Restart-Computer cmdlet with the -Force flag via PowerShell, a technique used by a recent malware dropper to disrupt sandbox analysis.
Detects HTTP requests utilizing a specific, highly verbose, and legacy Internet Explorer 8 User-Agent string. This exact hardcoded string is utilized by a fileless .NET loader (originating from a malspam campaign) to download subsequent payload stages from its staging server.
Detects the execution of AnyDesk using command line flags to run as a service or control utility, which is indicative of NightSpire ransomware persistence mechanisms.
Suspicious Conhost Headless Execution
Cortex XDR
Detects the execution of conhost.exe (or conhost.ext) with the --headless parameter, a technique used in ClickFix campaigns to silently execute clipboard-injected commands.
Detects process execution originating from the suspicious '%LOCALAPPDATA%\MicrosoftSystem64' directory, which is used as a persistence mechanism by a North Korean-linked npm infostealer RAT.
Payload Ransomware Log File Creation
Cortex XDR
Detects the creation of 'payload.log', a specific log file utilized by Payload ransomware to track its operational parameters. This file is typically dropped at the root of the C:\ drive.
Detects wscript.exe executing a JavaScript file from a user directory and subsequently spawning a PowerShell process with execution policy bypass (-nop) and encoded command (-enc) flags. This pattern is used by JS.MonoGlyphRAT to decrypt and execute AES-encrypted payloads while evading static analysis.
Page 231 of 249