Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
173 detections
Filters
Last updated
All Time
Detection languages
72
26
24
17
12
Contributors
62
35
12
11
5
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
93
62
25
21
12
Products / Services
36
31
23
15
12
MITRE Techniques
73
52
42
30
26
CVEs
3
2
IDS Classtypes
2
1
IDS Protocols
2
Detects the execution of remote commands on cloud virtual machines (Azure RunCommand or AWS SSM SendCommand) during defined off-hours (18:00 to 06:00). This rule identifies potentially unauthorized administrative or management activity occurring outside of standard business hours across cloud environments.
Detects high-frequency non-standard process executions involving WMI queries that specifically target virtual environment artifacts (e.g., VMware, VirtualBox, VBoxService, QEMU). This behavior is characteristic of sandbox or virtualization evasion, where malware attempts to identify if it is running in a virtualized or analysis environment to potentially alter its behavior.
Detects network connection activity originating from QEMU virtualization processes (qemu-system-x86_64, qemu-system-i386, qemu-system-aarch64) to external (non-private/non-local) IP ranges. This could indicate the use of virtualization tools to facilitate tunneling, proxying, or lateral movement within an environment.
Detects adversary activity associated with Payouts King and Black Basta affiliates utilizing QEMU for malicious activity. The rule monitors for the creation of virtual machine disk image files in non-standard directories, the execution of QEMU using disk images with misleading file extensions such as .db or .dll, and outbound SSH connections originating from the QEMU process to tunnel traffic through a guest VM.
Detects the execution of QEMU binary variants (qemu-system-x86_64.exe, qemu-system-i386.exe, or qemu.exe) when invoked with arguments indicative of guest networking or disk usage (e.g., -netdev, -drive). The rule further filters by identifying suspicious execution paths (e.g., Temp, AppData) or lack of legitimate hypervisor parent processes to identify potentially unauthorized virtualization or sandbox evasion activity.
Detects potential payload staging activities within a WSL2 environment where a process writes an executable or script to the Windows filesystem using the DllHost.exe (COM Surrogate) proxy. This rule uses process activity on the host to infer the presence of a WSL2 environment (wsl.exe or vmmem) and analyzes the absence of Windows-native network events, which is a characteristic pattern of WSL2-based network activity being hidden from Windows host telemetry.
Detects attempts to clone or snapshot sensitive virtual machines (such as Domain Controllers, PKI, Vault, ADFS, or SSO servers) in a VMware environment. The rule alerts on these activities when performed by non-administrator accounts outside of established maintenance windows, suggesting potential unauthorized data staging or credential extraction.
Detects the creation or registration of virtual machines using VMware ESXi CLI tools, PowerCLI, or Hyper-V PowerShell cmdlets. This behavior is often associated with adversary attempts to create backdoored VMs, isolate environments, or facilitate lateral movement and persistence within virtualized infrastructure.
Detects execution of virtualization-related tools and PowerShell cmdlets (New-VM, New-VHD) indicative of hypervisor management activities on Windows hosts. The rule monitors for processes such as vmconnect.exe, vmrun.exe, vmware.exe, and vmwp.exe, or specific PowerShell commands, excluding activity initiated by system-level accounts.
This rule detects potential cloud resource hijacking (e.g., cryptojacking) by monitoring for a sudden spike in the deployment of Azure virtual machines by a single user. It triggers if a user creates five or more virtual machines in a 10-minute window, specifically looking for deployments in regions where the user has not recently created VMs, or deployments utilizing high-compute SKUs commonly targeted for cryptocurrency mining.
Detects execution of rclone or the creation of an rclone configuration file (rclone.conf) occurring on a host within 24 hours of QEMU virtualization activity. This combination may indicate an adversary using virtualization software for staging or research, followed by data exfiltration via rclone to a remote cloud destination.
Detects the execution of QEMU binaries (qemu-system-x86_64, qemu-img, qemu-system-i386, qemu-system-aarch64) when launched from parent processes that are not standard virtualization or emulation management tools. This can indicate the use of QEMU for malicious purposes, such as unauthorized virtual machine execution, persistence, or secondary staging on a compromised host.
This rule detects the use of Rclone for cloud file synchronization or configuration file creation on endpoints that have shown recent activity related to QEMU virtualization. The detection correlates process execution or file creation events involving Rclone with prior QEMU execution within a 24-hour window, which may indicate an adversary using virtualization to stage or exfiltrate data.
Detects the execution of QEMU binaries or the utilization of .qcow2 disk files. The rule flags these activities as higher risk when they occur within common user-writable or temporary directories, which is a common indicator of unauthorized virtualization usage, staging for side-loading, or attempts to hide malicious artifacts within virtual disks.
This rule detects potential ransomware activity by monitoring for QEMU virtualization software spawning child processes followed by mass file encryption (using extensions .threeamtime or .bqtlock) and the creation of typical ransomware note files (e.g., RECOVER.txt, README.txt).
Detects the execution of QEMU hypervisor binaries (qemu-system-x86_64, qemu.exe, etc.) when initiated from non-standard parent processes or from non-standard directories, or when associated with disk image files. This behavior may indicate the unauthorized deployment of virtualization software to facilitate lateral movement, data exfiltration, or environment evasion.
Detects the use of VMware ESXi command-line management tools (esxcli, esxcfg) or VMware PowerCLI cmdlets (e.g., Connect-VIServer, Invoke-VMScript) from endpoints that are not identified as servers. This behavior often indicates an attacker attempting to manage or interact with a virtualized environment from a compromised workstation.
Detects the execution of QEMU emulator binaries (qemu-system-x86_64.exe, qemu-system-i386.exe, qemu.exe, qemu-img.exe) on a Windows host. This activity is associated with threat campaigns attempting to spawn hidden guest virtual machines to evade detection mechanisms and potentially stage ransomware or other malicious payloads.
Detects evidence of final-stage PayoutsKing or 3AM ransomware deployment by identifying the execution of shadow copy or backup catalog deletion commands on a host where the QEMU virtualization process is simultaneously active, indicative of ransomware activity following lateral movement via VM-based techniques.
Detects the execution of child processes by wsl.exe. Attackers may use the Windows Subsystem for Linux (WSL2) to execute code, stage payloads, or initiate network connections within the isolated WSL2 VM environment, potentially bypassing Windows-based endpoint monitoring and network security controls.
This rule detects activities related to the Windows Subsystem for Linux (WSL2), including the execution of wsl.exe, wslhost.exe, or wslservice.exe, as well as the active presence of the vmmemWSL virtual machine process. Monitoring WSL2 activity is important as adversaries can use the Linux environment to bypass traditional Windows security controls, execute Linux-native tools, or maintain persistence.
Page 5 of 9