Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,030 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects the execution of the windowless Java runtime (javaw.exe) originating from the C:\ProgramData\ directory. Threat actors, such as those deploying Nimbus RAT, often drop a bundled Java Runtime Environment (JRE/JDK) in ProgramData to evade detections that monitor standard Java installation paths.
Detects instances of QEMU emulators, particularly renamed binaries (e.g., svvhost.exe), executing with arguments indicative of loading a .qcow2 virtual disk image. BlackSuit affiliates are known to deploy QEMU virtual machines containing Linux or Windows operating systems to conceal backdoor proxy tools from host-level EDR.
Detects curl making direct HTTP requests to raw IPv4 addresses specifically seeking 'installer' binaries. This specific command-line pattern is a documented staging technique used by UNC3753 to deploy RMM payloads on victim machines.
Detects the execution of `cg.exe`, a secondary Python executable dropped by SilentRunLoader specifically to pack and steal Chrome browser data. This behavior is indicative of TA4922 activity.
Detects curl.exe being used to fetch content from Telegram channels and saving it to the AppData\Local\Temp directory, indicative of Gamaredon Dead Drop Resolver (DDR) resolution.
Detects the execution of conhost.exe with the --headless parameter. This technique is actively used in ClickFix campaigns to silently execute clipboard-injected commands in the background without user awareness.
Detects execution of the Bun runtime passing '_index.js' as a target, matching the Hades PyPI campaign loader behavior. This campaign leverages malicious `*-setup.pth` files to download Bun and run an obfuscated JavaScript credential stealer.
Detects the initiation of a FileSystemWatcher object in PowerShell configured to monitor the 'Changed' event. This technique is used by GammaSteel to actively monitor user operations in real time and steal documents the moment they are modified.
Detects PowerShell script logic associated with GammaSteel's fileless registry staging encryption, specifically the use of the DPAPI cmdlet ConvertTo-SecureString alongside the HKCU:\Printers path. This technique binds the encryption to the active user session to hinder forensic analysis.
Detects command-line attempts to access, dump, or export macOS Keychain data using the 'security' utility. This behavior is commonly exhibited by infostealers, such as MacSync Stealer, targeting saved passwords, cryptocurrency wallets, and developer credentials.
Page 235 of 249