Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,030 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects process execution containing the __DAEMONIZED=1 environment variable, which is used by the Shai-Hulud npm worm to detach from the parent process and run in the background.
Detects successful interactive device-code flow sign-ins through the Microsoft Authentication Broker application (Client ID 29d9ed98-a469-4536-ade2-f981bc1d605e). Tycoon 2FA operators frequently abuse this specific flow to bypass multi-factor authentication and steal session tokens.
Detects PowerShell script execution utilizing WMI event subscription (Register-WmiEvent) explicitly targeting the creation of logical disks with DriveType 2 (USB drives), a technique GammaSteel uses to steal data from physical media.
Detects macOS system fingerprinting targeting IOPlatformUUID using the ioreg command. This technique was observed being used by the FlutterShell malware (Operation FlutterBridge) to uniquely identify victims upon installation.
Detects WMI queries targeting the win32_logicaldisk class and filtering for mediatype=null. This specific query is used by Gamaredon's GammaWorm to identify network drives and removable drives (such as USBs) for malware propagation.
Detects PowerShell being executed with execution policy bypass and hidden window styles. This specific combination, particularly with the '-f' parameter, was utilized by the empty.vbs script to launch Profile.ps1 in the Dragon Weave campaign.
Detects the loading of UnityPlayer.dll from unexpected paths such as Temp or WebViewFixUtility. This behavior indicates potential DLL sideloading, as observed in Operation Dragon Weave, where RuntimeBroker_update.exe or BrowserViewUtility.exe loads a malicious UnityPlayer.dll (Rustcloak) to execute the Azureveil payload.
This query attempts to identify file events for javaapp.lock files which is used by Nimbus RAT as a way to to enforce single-instance execution.
Detects the creation of the java_app.lock file in the Windows temporary directory, which serves as a single-instance lock file for the Nimbus RAT.
Detects wscript.exe (or cscript.exe) executing a JavaScript file from the C:\Users\Public\ directory. This behavior is indicative of the relocated JScript loader stage observed in a recent malspam .NET loader campaign.
Page 238 of 249