Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,030 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects the execution of the GitHub CLI command used to print the active authentication token, which is abused by the Shai-Hulud worm to steal developer credentials.
Detects PowerShell command lines querying the HKCU:\Printers registry key and executing its contents via ScriptBlock creation. This technique is utilized by Gamaredon's GammaSteel malware for fileless registry staging and persistence.
Detects the execution of an Alternate Data Stream (ADS) payload located in the %TEMP% directory via wscript.exe, a critical persistence mechanism used by Gamaredon's GammaLoad.
Detects wscript.exe or cscript.exe executing a script hidden within an NTFS Alternate Data Stream (ADS). This technique is notably used by the Gamaredon group's GammaWorm to maintain fileless persistence and conceal malicious VBScript payloads (e.g., %USERPROFILE%:GTR).
Detects the execution of mshta.exe containing a URL with an '@' character to spoof a legitimate domain (e.g., www.bbc.com@malicious.com). This technique is used by Gamaredon in the GammaPhish stage to obfuscate the real C2 domain when launching initial HTA payloads.
Detects network connections originating from the Vulkan loader executable (`vulkaninfo.exe`) over port 1234. This behavior is indicative of TA4922 utilizing RomulusLoader to establish command and control communications and retrieve secondary payloads, such as RMM tools.
This rule detects the execution of 'net.exe' or 'net1.exe' with the command line containing 'time /domain' within 10 minutes after 'quickassist.exe' has been executed. This behavior can indicate an adversary performing system time discovery or domain reconnaissance after gaining initial access or establishing remote access via Quick Assist.
Detects DNS requests to the specific Azure Blob Storage subdomain used by the Azureveil Adaptix agent in Operation Dragon Weave as a dead-drop command and control server.
Detects the modification of Windows Explorer registry keys (Hidden, ShowSuperHidden, HideFileExt) designed to conceal files and file extensions. This defense evasion technique is notably used by the Gamaredon group's GammaWorm to hide dropped payloads, replaced LNK files, and malicious directories.
Detects the use of curl.exe to download files from public Telegram channels to the user's Temp directory. This is indicative of a Dead Drop Resolver (DDR) technique utilized by the Gamaredon group to retrieve Command and Control (C2) configuration data.
Page 236 of 249