Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5 detections
Filters
Last updated
All Time
Detection languages
3
2
Contributors
4
1
Categories
2
2
2
1
1
Platforms
3
2
Products / Services
2
2
1
1
1
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
IDS Classtypes
2
IDS Protocols
2
This rule detects JavaScript code within web traffic (proxy, web, or sandbox logs) that indicates attempts to block developer tools, prevent debugging, or detect automation drivers. Specifically, it looks for keywords and patterns associated with context-menu blocking, debugger statements, checks for browser window dimensions (often used to detect minimized or non-interactive browser windows), and the presence of automation-related strings like 'navigator.webdriver', 'selenium', or 'playwright'. This behavior is often observed in adversary-in-the-middle (AitM) phishing pages, such as those used by the Tycoon threat group, to hinder analysis and prevent automated detection.
Detects malware checking for user activity to detect sandbox environments
This rule detects potential sandbox evasion techniques by identifying HTTP traffic (specifically client-to-server responses) that contains both 'GetCursorPos' and 'Sleep' within the file data. This combination is often used by malware to check for user interaction (mouse movement) and introduce delays, which can indicate an attempt to determine if it's running in a sandboxed environment.
This rule detects potential sandbox evasion techniques by identifying HTTP traffic containing specific API calls often used by malware to determine if it's running in a sandboxed environment. Specifically, it looks for the 'GetForegroundWindow' function, which retrieves a handle to the foreground window, and the 'Sleep' function, which can be used to delay execution and bypass time-based sandbox analysis. The combination of these two indicates an attempt to check for user interaction and evade detection.
Detects malware checking for user activity to detect sandbox environments