Sandbox Evasion via Mouse Movement Check
This rule detects potential sandbox evasion techniques by identifying HTTP traffic (specifically client-to-server responses) that contains both 'GetCursorPos' and 'Sleep' within the file data. This combination is often used by malware to check for user interaction (mouse movement) and introduce delays, which can indicate an attempt to determine if it's running in a sandboxed environment.
Suricata
