Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,030 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects registry modifications to the specific CLSID {722D0F89-B69C-4700-AE8C-4A44350E4876} utilized by the Argamal RAT's Stage 1 PowerShell script. This establishes initial persistence to later download and decrypt the final payload.
Detects the use of regedit.exe to silently or explicitly import a .reg file located in the C:\ProgramData\ directory. This technique is used by threat actors, such as those deploying Nimbus RAT, to establish persistence.
Detects network traffic over TCP port 886, which is specifically used by Atlas RAT for command and control check-ins, plugin downloads, and encrypted data exfiltration in TA4922 campaigns.
Detects wscript.exe executing WMI queries targeting specific Win32 classes (such as Win32_SystemEnclosure, Win32_VideoController, etc.) to profile the host system. This behavior is associated with JS.MonoGlyphRAT, which extensively profiles systems before deploying secondary payloads.
Detects HTTP requests containing specific URL query parameter combinations (`ia=` and `df=`) or POST bodies containing `a=iz&b=`, which are unique to the JS.MonoGlyphRAT check-in and beaconing protocol.
Detects the creation of Vulkan components (e.g., vulkan-1.dll, .bin files) within the C:\Program Files\Common Files\ directory. This behavior is associated with TA4922 leveraging RomulusLoader for persistence via DLL sideloading.
Detects network requests associated with FallSpy, an Android spyware utilized by the Russia-nexus threat group GREYVIBE. FallSpy is deployed via fake persona lures and spoofed applications to harvest critical intelligence. While the original YARA rule targets file-based artifacts (e.g., class names like DataCollectorWork), this Sigma rule adapts the logic to focus on the highly reliable exfiltration URL parameters observable in proxy and web gateway logs.
Detects network connections originating from the Vulkan loader executable (vulkaninfo.exe) over port 1234, indicative of RomulusLoader C2 activity associated with TA4922.
Windows 365 Client Execution
Cortex XDR
Monitors for the execution of Windows 365 native clients. UNC3753 abuses legitimate VDI clients on compromised personal devices to bypass initial corporate perimeters and access sensitive network segments.
Detects network connections to the decoy C2 domain api.anthropic.com originating from development runtimes like Node.js, Python, or Bun. The Miasma/Shai-Hulud malware actively uses this specific domain as a decoy to obscure its data exfiltration and C2 traffic.
Page 237 of 249