Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,030 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects events that may indicate a user is being enrolled into a Bitwarden organization's account recovery policy under malicious circumstances. As described by researchers, a malicious or compromised server can silently add a user to an attacker-controlled organization and enable an account recovery policy. The victim's client will then encrypt the user's vault key with an attacker-provided public key and upload it, leading to a full vault compromise.
Monitors for the Microsoft Equation Editor process (EQNEDT32.exe) spawning an MSHTA process (mshta.exe). This behavior is highly indicative of CVE-2018-0802 exploitation, as seen in XWorm campaigns.
Detects the installation of the "Hotta Killer" tool, a Bring-Your-Own-Vulnerable-Driver (BYOVD) process killer used by the Interlock ransomware group to terminate security software. This is identified by the creation of a specific kernel driver file (`UpdateCheckerX64.sys`) and a corresponding Windows service with a distinct naming pattern (`UpdateCheckerX64_{random-numbers}`).
Detects persistence mechanisms used by the Interlock RAT, which leverages specific, deceptive scheduled task names related to Defrag, Chkdsk, and TimeSync to maintain a foothold on compromised systems.
Detects techniques used by the INC Ransomware Group, including the execution of their RainINC payload from C:\PerfLogs and the abuse of a renamed Restic binary for data exfiltration.
Detects network traffic to infrastructure associated with newly identified front companies linked to the Intellexa Predator spyware syndicate.
Detects the presence of a unique build path artifact associated with the PREYHUNTER iOS spyware stager, used by the commercial surveillance vendor Intellexa.
Detects network traffic to domains associated with Intellexa front companies, such as Pulse Advertise and MorningStar TEC, which are linked to the 'Aladdin' zero-click infection vector. This vector abuses the digital advertising ecosystem to deliver Predator spyware.
Detects unique strings associated with the JSKit iOS exploitation framework in network traffic. This framework is used by multiple threat actors, including the commercial surveillance vendor Intellexa, to deliver spyware like Predator.
Detects a PowerShell script used by Gootloader for reconnaissance. This script collects environment variables with a specific length limit, operating system details, and information about running processes.
Page 244 of 249