Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,030 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects the execution of MEGAsync.exe with the /upload argument, a technique used by NightSpire ransomware operators to exfiltrate staged data to MEGA cloud storage.
Detects the initial access attempt for the Oracle E-Business Suite vulnerability CVE-2025-61882. This involves a crafted POST request to the UiServlet component containing a malicious XML payload.
Detects the creation of the specific sentinel file '.bun_ran' generated by the Hades Python loader to avoid repeated executions.
Detects the creation of the specific sentinel file '.bun_ran' generated by the Hades Python loader to avoid repeated executions.
Detects the specific User-Agent string 'NSIS_InetLoad (Mozilla)' associated with the SessionGate multi-stage loader during its command and control (C2) check-ins. SessionGate is delivered via impersonated open-source tooling websites and gated TDS redirection chains.
Detects network traffic over TCP port 886, which is specifically used by Atlas RAT for command and control check-ins, plugin downloads, and encrypted data exfiltration in TA4922 campaigns.
Detects the use of bitsadmin.exe to download the Argamal RAT encrypted payload file (zaesdl.dat), a technique utilized in the Stage 2 delivery script.
Identifies bursts or requests to high-value Microsoft Graph API discovery endpoints. Tycoon 2FA operators frequently perform automated burst reconnaissance against these endpoints post-compromise to map out roles, tenant relationships, mailbox settings, and contacts.
Detects the creation of WMI Event Subscriptions containing the 'WinUpdate' string via PowerShell. This is a known persistence pattern used by Silent Stealer to masquerade its mechanisms as legitimate Windows Update tasks and survive system reboots.
Detects the loading of a malicious DLL by explorer.exe. This DLL is responsible for extracting a shellcode payload from a PNG file using steganography, a technique observed in the APT28 Phantom Net Voxel campaign.
Page 239 of 249