Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,030 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects the use of sed commands to delete specific competitor botnet entries (e.g., mirai, gafgyt) from system persistence files like crontab or rc.local, a key defense evasion and competitor killing tactic of C0XMO.
Detects modification of the InprocServer32 key for the Windows Color System Calibration CLSID, a persistence mechanism actively abused by the Argamal RAT to establish startup persistence tied to user login via a default Windows scheduled task.
Detects PowerShell scripts attempting to download and execute the official Deno installation script. This behavior is abused by threat actors, such as the operators behind the DinDoor backdoor, to silently prepare an endpoint for fileless JavaScript malware execution.
Identifies bursts or requests to high-value Microsoft Graph API discovery endpoints. Tycoon 2FA operators frequently perform automated burst reconnaissance against these endpoints post-compromise to map out roles, tenant relationships, mailbox settings, and contacts.
Detects the Deno runtime executing an in-memory script passed as a Base64-encoded Data URI, effectively bypassing disk monitoring. This technique is utilized by threat actors (e.g., DinDoor) to execute fileless malware payloads.
Detects network connections or web requests to the specific malicious GitHub repository paths used to host the 5th and 6th stage payloads of the Miasma malware (a Shai-Hulud variant).
Detects the use of `conhost.exe` with the `--headless` flag to stealthily execute the Deno runtime (`deno.exe`). This technique is utilized by the DinDoor backdoor to establish hidden persistence on compromised endpoints.
Detects outbound web requests or GitHub API interactions containing the specific description string "Miasma: The Spreading Blight". This string is used as a signature by the Miasma malware (a Shai-Hulud variant involved in the @redhat-cloud-services npm supply chain attack) when creating malicious GitHub repositories to exfiltrate stolen credentials.
Detects the execution of a Java runtime engine masquerading as 'miicrosoft.exe', a known evasive execution technique utilized by MicroStealer to run its payload.
Detects a potential attempt to downgrade a password manager client's encryption to a legacy, non-authenticated mode (e.g., AES-CBC). A malicious or compromised server can send a specially crafted response during login or synchronization that forces the client to use weaker cryptography. This can compromise the integrity and confidentiality of the user's vault, enabling further attacks like vault modification or padding oracles.
Page 243 of 249