Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,030 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects the creation of a child process by a known analysis, debugging, or reverse engineering tool. Malware like Stealit checks for these parent processes to determine if it's being analyzed. Spawning unexpected child processes from these tools can indicate malicious activity, such as the malware continuing its execution path after a failed anti-analysis check or a user interacting with a malicious file within a sandbox. The rule is filtered to exclude common legitimate child processes spawned by these tools.
Detects DNS requests to a known BNB Smart Chain Testnet JSON-RPC endpoint used by AnimateClipper to dynamically resolve its actual C2 domain via a smart contract.
Detects processes modifying or querying Windows Defender registry keys related to Potentially Unwanted Application (PUA) protection (PUAProtection, MpEnablePus). This behavior is observed in the SessionGate malware to verify its execution environment and evade detection before deploying further payloads.
Detects the execution of mshta.exe fetching a .7z payload from a remote URL, as observed in ClickFix campaigns delivering AnimateClipper.
Detects registry modifications to Windows Explorer Advanced settings designed to hide file extensions, hidden files, and protected operating system files. This defense evasion technique is commonly used by malware, such as Gamaredon's GammaWorm, to conceal dropped payloads and replaced LNK files from the user.
Detects the execution of mshta.exe containing a URL with an '@' character to spoof a legitimate domain (e.g., www.bbc.com@malicious.com), a technique used by Gamaredon in the GammaPhish stage to obfuscate the real C2 domain.
Detects Google Chrome being launched with multiple flags designed to suppress crash dialogs and session restore bubbles. This behavior is indicative of forced browser restarts after a hijacker modifies Secure Preferences, as seen with malware like FlutterShell and Calendaromatic (CL-CRI-1089).
Detects unauthorized modification of the Google Chrome Secure Preferences file, specifically targeting the default search provider data to hijack browser searches. This behavior is actively used by malware such as FlutterShell to redirect all Chrome searches to attacker-controlled infrastructure.
Detects the execution of arbitrary VBScript code dropped into the user's temporary directory by the GammaSteel C2 fallback mechanism. The payload is typically written to a temporary file and executed using wscript.exe with specific flags (//e:vbscript and //b).
Detects DNS requests to a known BNB Smart Chain Testnet JSON-RPC endpoint used by AnimateClipper to dynamically resolve its actual C2 domain via a smart contract.
Page 240 of 249