Duqu

ATP Sandbox Adv. HeuristicsAV

Stats

First seen: April 2022
Last seen: September 2026

MITRE ATT&CK techniques

21 techniques across 7 tactics.

TA0002 Execution

T1053Scheduled Task/Job
- T1053.005Scheduled Task

TA0003 Persistence

T1543Create or Modify System Process
- T1543.003Windows Service

TA0005 Stealth

T1055Process Injection
- T1055.001Dynamic-link Library Injection
- T1055.012Process Hollowing
T1078Valid Accounts
T1134Access Token Manipulation
T1218System Binary Proxy Execution
- T1218.007Msiexec

TA0007 Discovery

T1010Application Window Discovery
T1016System Network Configuration Discovery
T1049System Network Connections Discovery
T1057Process Discovery
T1087Account Discovery
- T1087.001Local Account

TA0008 Lateral Movement

T1021Remote Services
- T1021.002SMB/Windows Admin Shares

TA0009 Collection

T1056Input Capture
- T1056.001Keylogging
T1074Data Staged
- T1074.001Local Data Staging
T1560Archive Collected Data
- T1560.003Archive via Custom Method

TA0011 Command and Control

T1001Data Obfuscation
- T1001.002Steganography
T1071Application Layer Protocol
T1090Proxy
- T1090.001Internal Proxy
T1572Protocol Tunneling
T1573Encrypted Channel
- T1573.001Symmetric Cryptography

Alert name variants

Alert Name	Engine
Gen:Heur.Duqu.2	AV
Gen:Variant.Duqu.1	AV
Rootkit.Duqu.A	AV
Trojan.Duqu.C	AV
Trojan.Duqu.D	AV
Win32.Backdoor.Duqu	ATP Sandbox Adv. Heuristics
Win32.Infostealer.Duqu	ATP Sandbox Adv. Heuristics
Win32.Trojan.Duqu	ATP Sandbox Adv. Heuristics
Win64.Backdoor.Duqu	ATP Sandbox Adv. Heuristics
Win64.Trojan.Duqu	ATP Sandbox Adv. Heuristics

Related families

QakBot Cobalt Strike InvisiMole NETWIRE Empire