Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,030 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects the presence of specific string artifacts related to the TEASOUP JavaScript obfuscator within script blocks. TEASOUP is heavily used by the Russia-nexus threat group GREYVIBE to obfuscate initial access payloads in PhantomMail campaigns.
Detects the execution of the LegionRelay client script, a PowerShell RAT utilized by the Russia-nexus threat group GREYVIBE. LegionRelay communicates with its command-and-control server via REST API methods and relies on operator-staged scripts for post-compromise activity. The detection matches on specific REST API paths and PowerShell artifacts found within the script block.
Detects RomulusLoader persistence behavior where Vulkan components (such as vulkan-1.dll or .bin files) are written to the Common Files directory. This activity is associated with TA4922 and their use of RomulusLoader for initial access and staging.
Detects the execution of cg.exe, a secondary Python executable dropped by SilentRunLoader specifically to pack and steal Chrome browser data. This activity is associated with TA4922.
Detects processes attempting to scrape unmasked CI runner secrets from memory or using specific grep patterns associated with the Miasma worm. The worm escalates privileges to read Runner.Worker memory directly, bypassing standard GitHub Actions secret masking.
Detects the execution of commands indicative of a user pasting a malicious script into the Terminal, often associated with ClickFix or fake CAPTCHA social engineering attacks. This typically involves using tools like `curl` to download and pipe payloads directly to a shell, or the use of `pbpaste` to execute clipboard contents.
Detects suspicious modifications to the HKCU\Console registry key used by Gamaredon's GammaLoad to cache C2 URLs for persistence across executions.
WMI Drive Discovery By MediaType
Cortex XDR
Detects a specific WMI query used by GammaWorm to find network drives and low-cost USB drives for malware propagation by filtering for mediatype=null. This query targets 'win32_logicaldisk' and specifically looks for drives where 'mediatype=null', which can indicate network or removable drives.
Detects the creation or renaming of files to append the .nspire extension, a direct indicator of NightSpire ransomware encryption activity.
Detects network traffic to known Command and Control (C2) IP addresses and ports associated with the ClickFix Python RAT.
Page 232 of 249