Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,030 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects the specific use of RunDll32 to execute shell32.dll ordinal
Detects the creation of the specific hardcoded temporary file (~wra1269.tmp) used by the Argamal RAT to store captured screenshots during its surveillance operations prior to exfiltration.
Detects the silent or command-line driven installation of macOS configuration profiles (`profiles install`), which attackers use to bypass security settings or manage device configurations maliciously.
Detects a specific WMI query used by malware, such as Gamaredon's GammaWorm, to discover network drives (e.g., SMB mounts) and low-cost USB drives for malware propagation by filtering for mediatype=null.
Detects the execution of wscript.exe targeting a script concealed within an Alternate Data Stream (ADS) in the user profile directory. This technique is heavily used by Gamaredon's GammaWorm for persistence and execution.
Detects the execution of the Deno runtime attempting to fetch and run a remote script using the '-A' (allow all permissions) flag combined with an HTTP/HTTPS URL, a known behavior of the DinDoor backdoor and other malicious Deno abuse.
Detects outbound web requests or GitHub API interactions containing the specific description string "Miasma: The Spreading Blight". This string is used as a signature by the Miasma malware (a Shai-Hulud variant involved in the @redhat-cloud-services npm supply chain attack) when creating malicious GitHub repositories to exfiltrate stolen credentials.
Detects command line activity indicating the installation of packages from the compromised @redhat-cloud-services npm scope, which was leveraged in a supply chain attack to drop the Miasma/Shai-Hulud infostealer malware.
Detects the execution of scripts or commands containing the highly specific string 'firedalazer'. This string is hardcoded into the Miasma (a Shai-Hulud variant) dropper scripts to locate and fetch the 5th stage malicious payload from a specific GitHub commit.
Detects the Vampire Bot malware establishing persistence by copying itself to a suspicious directory and using 'attrib.exe' to set system and hidden file attributes.
Page 242 of 249