Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,030 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects the creation of Run or RunOnce registry keys being set with a specific "Update Drivers NVIDEO_" naming pattern. This behavior is indicative of a fileless .NET loader associated with a recent malspam campaign using masqueraded registry values to maintain stealthy persistence.
Detects the execution of 7-Zip with specific command-line arguments (password protection, zip format, mx5 compression) used by NightSpire ransomware for data staging prior to exfiltration.
Detects suspicious network connections to a non-existent Anthropic API endpoint (api.anthropic.com/v1/api). This specific route is used as network camouflage and decoy traffic by the Hades PyPI supply chain malware campaign.
VSS Shadow Copy Deletion
Cortex XDR
Detects the execution of vssadmin.exe to delete volume shadow copies, a common precursor to ransomware encryption utilized by Payload and other ransomware families. The rule specifically looks for `vssadmin.exe` being executed with the command-line arguments `delete shadows`, `/all`, and `/quiet`, indicating an attempt to silently remove all shadow copies.
Detects the creation or modification of a registry value within the HKCU Run key that points to wscript.exe executing a .js file. This is the primary persistence mechanism for JS.MonoGlyphRAT to maintain a foothold on compromised US enterprise systems.
Detects DNS requests to domains matching known UNC3753 data leak sites or phishing domains masquerading as IT helpdesks. Identifying connections to these domains can serve as an early warning of an ongoing vishing campaign or active extortion scenario.
Detects DNS queries resolving privnote.com. This self-destructing message service is actively abused by threat actors like UNC3753 to transmit malicious installation links and commands to compromised users while bypassing traditional chat and email filtering.
UNC3753 Infrastructure Connection
Cortex XDR
Detects DNS requests to domains matching known UNC3753 data leak sites or helpdesk impersonation patterns utilized during vishing campaigns. This rule specifically looks for the domain "business-data-leaks.com" and domains ending with "-itdesk.com", "-helpdesk.com", or "-it.com".
Detects successful Microsoft Entra ID sign-ins where the user agent indicates a Node.js-based HTTP client (e.g., node, axios, undici, node-fetch). Tycoon 2FA and other AiTM phishing kits heavily leverage these backend automated tools for token relay and renewal immediately following MFA interception.
Detects the execution of wscript.exe loading a VBScript from a relative suspicious subdirectory like ".\data\", indicative of the initial LNK-based infection chain observed in Operation Dragon Weave.
Page 234 of 249