Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,030 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Hades Decoy Anthropic Traffic
Cortex XDR
Detects suspicious network connections to the Anthropic API endpoint (api.anthropic.com/v1/api) used as exfiltration camouflage by the Hades campaign. The rule specifically looks for traffic to 'api.anthropic.com' with the path '/v1/api', which is documented as returning 404s, indicating potential misuse for covert communication or data exfiltration.
Hades Sentinel File Creation
Cortex XDR
Detects the creation of the '.bun_ran' sentinel file in the system temp directory, used by the Hades malicious PyPI loader to avoid repeated executions. This file acts as a marker to prevent subsequent infections or executions of the malware.
Detects PowerShell script block contents indicating the manual bypassing of SSL certificate validation. This defense evasion technique is notably used by the Gamaredon GammaLoad third stage (which executes via an encoded command) to ensure successful connection to potentially untrusted or self-signed C2 infrastructure.
Detects the execution of PowerShell scripts containing strings associated with the DAYLIGHT obfuscator. This obfuscator is utilized by the Russia-nexus threat group GREYVIBE to hide post-compromise payloads and PhantomRelay implants.
Detects unusual network traffic over TCP port 886, which is specifically used by Atlas RAT for command and control check-ins and encrypted data exfiltration in recently observed TA4922 campaigns.
Detects cURL making direct HTTP requests to raw IPv4 addresses specifically seeking 'installer' binaries. This specific command-line pattern is a documented staging technique used by UNC3753 to deploy RMM payloads on victim machines.
Monitors for the execution of Windows 365 native clients (Windows365.exe). Threat actors, such as UNC3753, abuse legitimate Virtual Desktop Infrastructure (VDI) clients on compromised personal Bring Your Own Device (BYOD) endpoints to bypass initial corporate perimeters and access sensitive network segments.
Suspicious MSHTA Fake Auth URL
Cortex XDR
Detects mshta.exe executing a remote URL that contains an '@' symbol, a technique used by Gamaredon (GammaPhish) to fake authentication and bypass naive URL filtering.
Detects network connections to the hardcoded GammaSteel fallback C2 IP address (165.22.170.129) and domain (justsstop.ru). These hardcoded IOCs are used as a failsafe when primary S3 exfiltration fails or DDR configurations are lost, indicating an active data theft operation.
WScript Execution From ADS
Cortex XDR
Detects wscript.exe or cscript.exe executing a script from an Alternate Data Stream (ADS) path, specifically within the Users directory, as indicated by a colon without a preceding drive letter context. This behavior is known to be used by malware like GammaWorm for persistence by executing hidden VBScript payloads.
Page 233 of 249