Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
236 detections
Filters
Last updated
All Time
Detection languages
83
49
29
20
17
Contributors
91
31
26
26
9
Categories
109
70
37
36
36
Platforms
183
23
22
9
2
Products / Services
71
56
24
21
19
MITRE Techniques
18,115
15,635
12,582
8,393
6,220
IDS Classtypes
14
4
2
IDS Protocols
20
Detects network indicators associated with the ORAX Phishing-as-a-Service (PhaaS) platform. This includes patterns for emoji-matching CAPTCHAs, spoofed Cloudflare security pages, specific wildcard subdomain DNS queries, and the use of anti-analysis gate sequences to prevent sandbox inspection.
Detects outbound HTTP GET requests directed towards FingerprintJS CDN services that are triggered from or referred by pages hosted on disposable platforms such as Vercel or Netlify. This pattern is commonly indicative of evasion gates or bot-fingerprinting lures used in phishing campaigns to profile victim environments before delivering secondary payloads.
Detects a sequence of activity where an endpoint performs multiple anti-analysis or sandbox evasion checks (using commands like wmic, powershell, or reg to query system information or look for debugger/VM artifacts) followed within 10 minutes by an outbound network connection to a domain that has not been observed from that specific device in the last 7 days.
Detects a specific bot-cloaking technique used by the Exvicy/ErrTraffic framework, where an actor makes requests to bot-decision endpoints (index.php/white.php) while providing a spoofed 'google.com' Referer header to a non-Google destination host. This technique is often used to facilitate the delivery of fraudulent content (e.g., fake Turnstile/ClickFix pages) while evading detection by security scanners and undesired geographic regions.
Detects potential anti-analysis or sandbox evasion behavior where a process checks for the existence of the Cursor IDE application using native system utilities like ps, pgrep, or lsof. This check is often used by malware (such as the FLATROOF/ROOFDECK backdoors) to gate beaconing activity by ensuring the execution environment is not an analysis sandbox.
Detects PowerShell execution containing multiple command-line arguments indicative of environment discovery, such as checking system uptime, hardware specifications, or specific memory-related delays. These patterns are commonly used by malware to detect virtual machines, sandboxes, or analysis environments to alter execution or exit.
Detects the use of tasklist.exe combined with process filtering (findstr) to identify common debugger names such as 'dbg.exe', 'x64dbg.exe', 'windbg.exe', or 'ollydbg.exe'. This technique is a known evasion tactic employed by the Kimsuky threat group (and others) to check for the presence of analysis tools before continuing execution of malicious batch scripts.
Detects executable files launched from torrent-related directories or parent processes that perform reconnaissance commands or registry queries indicative of sandbox or virtualization detection, a technique observed in the MovieReaper malware loader.
Detects the execution of a RevStealer native PE payload by an Electron-based loader (XabivSystem.exe). The rule identifies when the loader spawns an unsigned, detached process from a hidden, randomly-named subdirectory within the user's AppData folder. This process creation is a precursor to the malware's environment checks, anti-VM/sandbox gating, and CAPTCHA verification routines.
This rule detects the presence of the 'antiSNG' flag in command-line arguments of newly created processes. This flag is specific to the configuration of Hannibal Stealer, which uses it to perform anti-analysis checks, likely related to geofencing or environmental detection to evade sandbox or security analyst investigation.
Detects network beaconing activity associated with the Casbaneiro (Metamorfo) banking trojan. The rule monitors for specific C2 communication patterns, including the 'client;' string and the 'VVx-4.3' version marker, which are characteristic of this malware's host reconnaissance and command-and-control exfiltration phase.
Detects the initialization sequence of the ORAX command-and-control framework, characterized by a handoff via a spoofed Cloudflare verification page followed by a WebSocket upgrade request.
These rules detect behavioral patterns associated with GhostCode-style anti-analysis, including URI-based gate redirection (turnstile checks), automated client filtering (User-Agent scanning), and UI-based spoofing (tab title masquerading) often used to protect malicious infrastructure from automated analysis tools and bots.
Detects Android malware performing anti-debugging, anti-instrumentation, and environmental checks to evade analysis. The rule monitors for processes querying system properties, checking for debugging artifacts like TracerPid, attempting to locate Frida instrumentation agents, or identifying rooting/Xposed framework artifacts and emulator-specific files.
This rule set detects web traffic associated with 'GhostCode' phishing campaigns. These campaigns utilize Cloudflare Turnstile verification gates on non-Cloudflare domains, specific phishing page titles, and session cookies ('turnstile_verified', 'cf_clearance') to facilitate device code phishing or credential harvesting activities.
This rule detects potential attempts to tamper with or bypass Windows Defender by monitoring for files or processes named 'ShieldCrash' occurring in close temporal proximity to the creation or modification of files within Windows Defender's shadow or scan directories (BaseNamedObjects\Restricted\WD_SHADOW_ or WD_SCAN). This behavior is often associated with malware attempting to evade security detection.
This rule detects the execution of PowerShell commands that simultaneously perform reconnaissance for security analysis tools and virtual machine environment indicators. The presence of encoded, hidden, or non-interactive PowerShell flags in conjunction with these discovery actions is indicative of an adversary attempting to verify their execution environment to evade detection and analysis by security researchers or automated sandbox systems.
Detects the execution of standard Windows command-line utilities (cmd.exe, wmic.exe, powershell.exe, fsutil.exe, vol.exe) used to query local volume information, such as name and serial number. This behavior is frequently associated with environment fingerprinting or sandbox evasion, particularly when executed by suspicious processes like mshta.exe as part of initial infection chains such as ClickFix payloads.
This rule detects potential attempts to tamper with or bypass Windows Defender by monitoring for files or processes named 'ShieldCrash' occurring in close temporal proximity to the creation or modification of files within Windows Defender's shadow or scan directories (BaseNamedObjects\Restricted\WD_SHADOW_ or WD_SCAN). This behavior is often associated with malware attempting to evade security detection.
Detects the RevStealer malware family using an Electron-based loader to perform anti-sandbox host validation. The loader attempts to identify virtualized environments by querying GPU hardware information using wmic or PowerShell CIM/WMI commands before proceeding to disable security features or launch the payload.
This rule detects potential malicious activity by monitoring for specific file hashes, specific suspicious filenames, and suspicious command-line patterns (e.g., 'antivm') initiated by known update or launcher processes. This is likely an indicator of malware behavior involving anti-sandbox or evasion techniques.
Page 2 of 12