Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
192 detections
Filters
Last updated
All Time
Detection languages
68
31
28
18
17
Contributors
79
31
29
13
7
Categories
83
48
48
30
25
Platforms
152
17
11
9
6
Products / Services
42
42
16
16
15
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
IDS Classtypes
10
6
1
IDS Protocols
16
Detects execution of virtualization and container software on Windows endpoints by image name, covering Hyper-V, VMware, VirtualBox, QEMU, Xen, Parallels, WSL, Docker and containerd. Attackers can run payloads inside a virtual machine or WSL instance to hide activity from host-based security tools. Developers and administrators use these tools routinely, so the rule suits inventory and hunting. To triage, check the user, parent process, command line and hash, and whether the host is expected to run virtual machines.
Correlates a Webcam.dll image load with VM-detection commands (such as queries for VirtualBox, VMware, vbox, vmtoolsd, Win32_ComputerSystem, or Win32_BIOS) executed by the same RegSvcs.exe process, which is characteristic of XWorm malware behavior.
Correlates a Webcam.dll image load with VM-detection commands (such as queries for VirtualBox, VMware, vbox, vmtoolsd, Win32_ComputerSystem, or Win32_BIOS) executed by the same RegSvcs.exe process, which is characteristic of XWorm malware behavior.
Detects HTTP traffic associated with the Wazza phishing kit anti-bot mechanism, including token minting requests, signed token responses, and validation checks.
Detects HTTP traffic associated with the Wazza phishing kit anti-bot mechanism, including token minting requests, signed token responses, and validation checks.
Detects HTTP traffic associated with the Wazza phishing kit anti-bot mechanism, including token minting requests, signed token responses, and validation checks.
Detects HTTP traffic associated with the Wazza phishing kit anti-bot mechanism, including token minting requests, signed token responses, and validation checks.
Detects a process querying multiple distinct registry keys associated with virtual environments (VMware, VirtualBox, Wine) in a short time window. This behavior is indicative of environmental profiling performed by malware (such as 2CLoader) to detect sandbox or analysis environments prior to malicious payload execution.
Detects a process querying multiple distinct registry keys associated with virtual environments (VMware, VirtualBox, Wine) in a short time window. This behavior is indicative of environmental profiling performed by malware (such as 2CLoader) to detect sandbox or analysis environments prior to malicious payload execution.
Detects a process querying multiple distinct registry keys associated with virtual environments (VMware, VirtualBox, Wine) in a short time window. This behavior is indicative of environmental profiling performed by malware (such as 2CLoader) to detect sandbox or analysis environments prior to malicious payload execution.
Detects a process querying multiple distinct registry keys associated with virtual environments (VMware, VirtualBox, Wine) in a short time window. This behavior is indicative of environmental profiling performed by malware (such as 2CLoader) to detect sandbox or analysis environments prior to malicious payload execution.
Detects a process querying multiple distinct registry keys associated with virtual environments (VMware, VirtualBox, Wine) in a short time window. This behavior is indicative of environmental profiling performed by malware (such as 2CLoader) to detect sandbox or analysis environments prior to malicious payload execution.
The FileFix StealC campaign's final-stage loader is written in Go and performs VM/sandbox checks plus string encryption before executing the infostealer.
Detects instances where rundll32.exe loads a DLL file named Use.dll from a subdirectory named 'ComponentsFolder' within the AppData directory. This pattern is indicative of sandbox evasion techniques used by malware, such as the DarkMe RAT, where the DLL acts as an anti-sandbox gateway to check the execution environment.
Detects the execution of PowerShell with the -NoProfile flag initiated by wscript.exe or cscript.exe, containing sleep/delay commands alongside network download functions. This pattern is characteristic of malware loaders or RMM phishing kits attempting to evade sandbox analysis before initiating a remote download.
Detects a trojanized Electron application performing anti-sandbox environment checks by querying GPU hardware information via WMI or PowerShell CIM cmdlets. This activity is characterized by the presence of the PYTHONUTF8 environment variable and is identified as a precursor step to attempting Microsoft Defender exclusions and launching a malicious payload.
Detects processes querying registry keys or accessing file paths associated with common virtualization and sandbox environments (e.g., VMware, VirtualBox, Hyper-V, Sandboxie). This behavior is often indicative of malware attempting to identify if it is running in an analysis or sandbox environment to evade detection.
Detects network activity associated with ORAX Phishing-as-a-Service (PhaaS), specifically identifying fake Cloudflare security-verification pages and emoji-based CAPTCHA gates used as anti-analysis techniques to frustrate automated sandboxing.
This rule detects network traffic patterns associated with the ARToken phishing campaign, specifically identifying access to lure pages hosted on 'workers.dev' domains with 'docviewer' in the hostname and 'turnstile' challenge responses in the HTTP body, which is used for anti-analysis/evasion.
Detects VBScript files that exhibit characteristics of a downloader or dropper, including common Windows API usage (WScript.Shell, Shell.Application, MSXML2.XMLHTTP, ADODB.Stream), staging in the C:\Users\Public\ directory, and performing sandbox evasion via WMI InstallDate checks.
Detects a sequence of activity where an endpoint performs multiple anti-analysis or sandbox evasion checks (using commands like wmic, powershell, or reg to query system information or look for debugger/VM artifacts) followed within 10 minutes by an outbound network connection to a domain that has not been observed from that specific device in the last 7 days.
Page 1 of 10