Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,030 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects the creation of a mutex with a specific pattern used by the MonsterV2 malware, a sophisticated RAT, loader, and stealer.
Detects the installation of browser extensions, primarily cryptocurrency wallets, that are known targets for the Stealit information stealer.
Detects known MonsterV2 malware samples based on their SHA256 file hashes. Detecting these hashes on endpoints can directly identify MonsterV2 infections.
Detects the execution of executables with specific names ("WinHealth.exe", "WindowsSecurity.exe") known to be dropped by the SonicCrypt crypter. The execution is often initiated by the Task Scheduler, resulting in a parent process of 'taskhostw.exe'.
Detects the creation of a child process by a known analysis, debugging, or reverse engineering tool. Malware like Stealit checks for these parent processes to determine if it's being analyzed. Spawning unexpected child processes from these tools can indicate malicious activity, such as the malware continuing its execution path after a failed anti-analysis check or a user interacting with a malicious file within a sandbox. The rule is filtered to exclude common legitimate child processes spawned by these tools.
Detects the execution of common process and memory analysis tools. The presence of these tools on a standard user endpoint could indicate reconnaissance, reverse engineering, or an attempt by malware to check for an analysis environment. This list is based on tools blacklisted by the Stealit malware.
Detects the execution of game_cache.exe, stats_db.exe, or save_data.exe from a randomly named subdirectory within specific AppData\Local folders (like SystemCache, WindowsCache, AppCache, etc.).
Detects the initial access attempt for the Oracle E-Business Suite vulnerability CVE-2025-61882. This involves a crafted POST request to the UiServlet component containing a malicious XML payload.
Detects suspicious child processes spawned by a Java process, which may indicate post-exploitation activity related to the Oracle E-Business Suite vulnerability CVE-2025-61882. The exploit chain often results in a reverse shell.
Detects PowerShell commands using `curl -o` to download `.dll`, `.pyc`, or other suspicious file extensions to temporary user directories. This technique was observed being used by the Confucius group to download their malware components.
Page 248 of 249