Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,030 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects network connections to domains associated with Argamal RAT command and control infrastructure.
Identifies suspicious token authorizations for the Google Chrome OAuth client. Tycoon 2FA operators frequently use this specific client and scope to proxy authentications and capture session cookies. In a complete attack sequence, this event occurs within a 1-second window alongside a login_success and a device registration event.
Detects network connections to known Command and Control (C2) servers associated with the ValleyRAT backdoor, used by the Silver Fox APT group.
Detects the execution of Microsoft Edge WebView2 (msedgewebview2.exe) with flags indicating an embedded browser instance and a custom user data directory pointing to the AppData\Roaming folder. This behavior is commonly leveraged by malware masquerading as simple utilities, such as the Calendaromatic malware (CL-CRI-1089), to interact with the host operating system and hide malicious activities within webview processes.
Detects macOS system fingerprinting targeting IOPlatformUUID using the ioreg command. This technique was observed being used by the FlutterShell malware (Operation FlutterBridge) to uniquely identify victims upon installation.
Detects the usage of the Windows Package Manager (WinGet) to install the Deno runtime environment. Threat actors (e.g., the operators behind the DinDoor backdoor) abuse native package managers to silently install runtimes required for their payloads without triggering alerts.
Detects registry interactions querying or accessing the Windows Defender Application Guard (WDAG) RunOnce registry key. This behavior is associated with Atlas RAT performing anti-sandbox and anti-analysis checks prior to payload execution.
Detects attempts to bypass User Account Control (UAC) by hijacking the execution flow of the auto-elevated fodhelper.exe binary via modifications to the ms-settings registry keys in the HKCU hive. Silent Stealer leverages this specific registry hijack to seamlessly gain elevated privileges without triggering user prompts, an essential step for its deep credential extraction processes.
Detects the execution of hidden payloads within temporary or shared memory directories (/tmp, /var/tmp, /dev/shm). This behavior is commonly associated with the C0XMO Gafgyt botnet variant, which copies itself to these hidden '.sys' files to maintain persistence and evade detection.
Detects the installation of specific Python packages (requests, paramiko, beautifulsoup4) combined with potential system-breaking flags, indicating the preparation phase for C0XMO's standalone lateral movement scanner.
Page 241 of 249