Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
236 detections
Filters
Last updated
All Time
Detection languages
83
49
29
20
17
Contributors
91
31
26
26
9
Categories
109
70
37
36
36
Platforms
183
23
22
9
2
Products / Services
71
56
24
21
19
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
IDS Classtypes
14
4
2
IDS Protocols
20
Detects LegionLoader malware performing environmental fingerprinting by querying specific Windows registry keys (Internet Settings Zones and CentralProcessor) in rapid succession. This behavior is indicative of a multi-stage check to identify sandbox or virtual machine environments before executing the final payload.
This rule detects the execution of specific suspicious binaries (HFY.exe or tcc.exe) or registry queries looking for common virtual machine guest additions (VMware or VirtualBox artifacts). These activities are often associated with malware attempting to detect if it is running within a virtualized or sandboxed analysis environment.
Detects suspected sandbox evasion techniques commonly utilized by BeepRAT malware. The rule monitors for WMI queries related to hardware/OS virtualization artifacts (e.g., CIM_Memory, Win32_OperatingSystem), registry enumeration of virtualization keys (VMware/VirtualBox), and suspicious child process spawning of wmiprvse.exe by known loader components (HFY.exe, tcc.exe, LuaJit.exe).
Detects WMI activity used by the BeepRAT loader to query system information (Win32_OperatingSystem, CIM_Memory), which is characteristic of virtualization and sandbox evasion techniques. The rule correlates process creation and WMI event logs with known indicators associated with BeepRAT deployment.
Detects BeepRAT malware exhibiting anti-analysis behavior by performing a sequence of environment-fingerprinting checks within a 60-second window. The rule monitors for a combination of registry queries targeting virtualization artifacts (VMware, VirtualBox) and WMI queries for system hardware/OS information (Win32_OperatingSystem, CIM_Memory), which are common techniques used by BeepRAT to detect virtual machines and sandboxes before execution.
Detects registry queries for common virtualization-related artifacts (e.g., VMware, VirtualBox) performed by specific suspicious processes. This behavior is indicative of sandbox or virtual machine evasion techniques used by malware to detect if it is running in an analysis environment before executing its malicious payload.
This rule detects registry activity that indicates the presence of a virtualization or sandbox environment. Malware often checks for such environments to evade analysis. The rule specifically looks for registry keys and values associated with VMware and VirtualBox.
Detects payloads that check domain membership before executing
Detects the use of wmic.exe or powershell.exe by common scripting interpreters (python.exe, chost.exe) to query system information via WMI, specifically targeting hardware identifiers (Win32_ComputerSystem, Win32_NetworkAdapterConfiguration) or MAC addresses. This behavior is indicative of virtualization or sandbox evasion techniques, where malware attempts to identify if it is running within an analysis environment by checking hardware signatures.
Detects the use of wmic.exe or powershell.exe by common scripting interpreters (python.exe, chost.exe) to query system information via WMI, specifically targeting hardware identifiers (Win32_ComputerSystem, Win32_NetworkAdapterConfiguration) or MAC addresses. This behavior is indicative of virtualization or sandbox evasion techniques, where malware attempts to identify if it is running within an analysis environment by checking hardware signatures.
Detects multiple concurrent attempts by a process to identify virtualization or analysis environments (sandbox evasion). The rule monitors for registry key lookups related to VMware/VirtualBox, as well as the execution of commands (via wmic, powershell, or tasklist) aimed at enumerating system information such as video controllers, boot times, operating system details, or process lists. An alert is generated when three or more distinct types of these checks are observed within a 60-second window by the same process, excluding administrative or system-level accounts.
Detects the Chromelevator loader (drun.exe) performing reflective injection of an encrypted payload DLL into a remote process using direct syscalls (NtAllocateVirtualMemory, NtWriteVirtualMemory, NtCreateThreadEx) to bypass EDR hooks. Also detects the spawned vt-windows-event-stream.exe helper process.
Detects execution of a WMI query targeting Win32_VideoController to retrieve the CurrentRefreshRate property. This behavior is associated with the OXLOADER malware family, which uses this check to identify sandbox or virtualized environments (typically with refresh rates of 20Hz or lower) and abort execution to evade analysis.
Identifies Kazuar querying specific CPU or BIOS registry keys (VMware, VBox) to halt execution if it detects an analysis environment. This rule specifically looks for registry access to 'HARDWARE\DESCRIPTION\System\BIOS' combined with a process executing 'wmic bios get' on the command line.
This rule detects JavaScript code within web traffic (proxy, web, or sandbox logs) that indicates attempts to block developer tools, prevent debugging, or detect automation drivers. Specifically, it looks for keywords and patterns associated with context-menu blocking, debugger statements, checks for browser window dimensions (often used to detect minimized or non-interactive browser windows), and the presence of automation-related strings like 'navigator.webdriver', 'selenium', or 'playwright'. This behavior is often observed in adversary-in-the-middle (AitM) phishing pages, such as those used by the Tycoon threat group, to hinder analysis and prevent automated detection.
Detects suspicious combinations of API calls and system monitoring often used by the VILE ransomware family to evade debuggers, sandboxes, and automated analysis environments. This includes detecting the registration of Vectored Exception Handlers (VEH), memory checks for debugging artifacts, reading the Process Environment Block (PEB), and monitoring for file restoration activities via ReadDirectoryChangesW.
Detects potential SNOWLIGHT dropper behavior where a process associated with Windows Update (wusvc.exe) is observed alongside environment naming conventions indicative of analysis sandboxes (e.g., 'malware', 'sandbox', 'virus', 'sample'). This combination of process naming and environment characterization suggests evasion or anti-analysis techniques typical of malware droppers.
This rule monitors registry modifications for keys or values related to common virtualization platforms (VirtualBox, VMware, QEMU, Xen, Hyper-V). Such registry queries or modifications are often indicative of malware performing sandbox evasion to determine if the execution environment is a virtual machine or a sandbox used for analysis, allowing the malware to terminate or alter its behavior to avoid detection.
Detects behaviors associated with AMOS and Odyssey Stealer, including using osascript to perform anti-analysis checks via system_profiler and terminating OneDrive services to impair defenses.
Detects the execution of executables with specific names ("WinHealth.exe", "WindowsSecurity.exe") known to be dropped by the SonicCrypt crypter. The execution is often initiated by the Task Scheduler, resulting in a parent process of 'taskhostw.exe'.
Detects execution of timeout.exe or ping.exe with specific command-line arguments often used by Pay2Key ransomware to implement time-delay mechanisms for sandbox and analysis evasion.
Page 9 of 12