Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
173 detections
Filters
Last updated
All Time
Detection languages
72
26
24
17
12
Contributors
62
35
12
11
5
Categories
20,401
11,795
5,864
5,145
4,864
Platforms
93
62
25
21
12
Products / Services
36
31
23
15
12
MITRE Techniques
73
52
42
30
26
CVEs
3
2
IDS Classtypes
2
1
IDS Protocols
2
Detects a sequence of events on a single host within a 10-minute window involving both the deletion of Volume Shadow Copies (using vssadmin.exe or wmic.exe) and the execution of ESXi management commands (using esxcli or vmware binaries). This behavioral pattern is often indicative of ransomware attempting to inhibit system recovery and interfere with virtualized infrastructure components concurrently.
Detects the creation or registration of virtual machines across multiple hypervisor platforms (Hyper-V, VMware ESXi, and VirtualBox) using PowerShell, command-line utilities, or security event logs. The rule alerts on these actions when performed outside of designated business hours or by accounts not included in a pre-defined list of authorized administrators.
Detects the execution of QEMU binary components (qemu-system-x86_64.exe, etc.) on Windows hosts when spawned by suspicious parent processes or with command-line arguments indicative of VM disk image handling or non-interactive execution. This behavior is used by threat actors to execute malicious payloads within a virtualized container to evade host-based EDR monitoring and security controls.
This rule detects the execution of the QEMU virtualization engine (qemu-system-x86_64.exe) when associated with specific toolset files (e.g., BloodHound, Metasploit) or suspicious network activity patterns indicative of lateral movement, such as connecting to administrative ports (SMB, RDP, WinRM) on external or sensitive network ranges. The rule calculates a risk score based on the presence of these indicators.
Detects the simultaneous execution of QEMU virtualization processes and post-exploitation tools (Metasploit, Impacket, Havoc, NXC) on the same host. This combination is indicative of an adversary using a local virtual machine to tunnel or pivot lateral movement activities while leveraging post-exploitation frameworks on the host system, a behavior observed in specific campaigns.
Detects suspicious use of QEMU virtualization software within an environment, specifically when associated with ConnectWise ScreenConnect. This includes the creation of custom QEMU image files within the ScreenConnect Files directory, the execution of the QEMU binary using those images, the extraction of QEMU archives using 7-Zip, or instances where ScreenConnect processes spawn the QEMU binary directly. This pattern is indicative of unauthorized use of virtual machines to facilitate persistence, lateral movement, or tool staging.
Detects a sequence of events on a single host within a 10-minute window involving both the deletion of Volume Shadow Copies (using vssadmin.exe or wmic.exe) and the execution of ESXi management commands (using esxcli or vmware binaries). This behavioral pattern is often indicative of ransomware attempting to inhibit system recovery and interfere with virtualized infrastructure components concurrently.
This rule detects qemu-system processes acting as parents for known tunneling or network utility tools, or qemu-system instances explicitly configured with suspicious command-line parameters (e.g., tap, socket connect, virtio-net) indicative of covert command and control (C2) communication. This behavior is associated with threat actors using Alpine Linux virtual machines within QEMU to bypass host EDR visibility.
Detects instances where the Windows Subsystem for Linux (WSL) processes (wsl.exe or wslhost.exe) are spawned by suspicious parent processes, which may indicate an attempt to use WSL for payload execution or persistence on hosts where its usage is restricted or not authorized.
Detects rapid succession of power-off, suspend, or destroy operations on virtual machines via esxcli or vim-cmd following an SSH login, a behavior pattern often associated with ESXi ransomware activity (e.g., Qilin).
Detects the execution of QEMU processes configured with specific network redirection flags (hostfwd) targeting standard SSH ports, or utilizing suspicious file paths (e.g., .db, .dll) as virtual disk backing files. This behavior is indicative of adversaries utilizing QEMU to establish covert reverse SSH tunnels or staging malicious artifacts within virtualized environments.
Detects the execution of QEMU binary processes with command-line arguments targeting database or virtual disk files (e.g., .qcow2, .db) or matching known malicious file hashes. This behavior is indicative of unauthorized use of virtualization tools to execute payloads, conduct forensics, or manipulate virtual disk images in an environment.
This rule detects the creation, modification, or startup of virtual machines using common administrative tools such as PowerShell (Hyper-V), vmrun (VMware), VBoxManage (VirtualBox), and vSphere CLI tools. Such activities can be indicators of adversary efforts to create hidden virtual environments, stage malicious payloads, or perform unauthorized administrative actions on virtualized infrastructure.
Detects high-frequency non-standard process executions involving WMI queries that specifically target virtual environment artifacts (e.g., VMware, VirtualBox, VBoxService, QEMU). This behavior is characteristic of sandbox or virtualization evasion, where malware attempts to identify if it is running in a virtualized or analysis environment to potentially alter its behavior.
Detects the execution of QEMU processes, the presence of suspicious virtual disk files (e.g., .qcow2, .db) in unexpected locations, and the installation of Virtio drivers. These patterns may indicate an adversary is deploying hidden virtual machines to bypass host-based security controls.
Detects the creation of scheduled tasks that involve QEMU virtualization binaries or virtual disk images. This activity is associated with the GOLD ENCOUNTER threat group and campaigns STAC4713/STAC3725, which utilize QEMU to facilitate persistence and infrastructure defense evasion by maintaining virtualized environments across system reboots.
Detects the creation of a new .vhdx virtual disk file by hypervisor management processes. This behavior is used by threat actors, specifically Akira ransomware, to instantiate new virtual machines that lack organizational security tooling to evade endpoint detection before proceeding with malicious activities.
Detects the execution of command-line tools associated with virtual machine management (ESXi CLI, PowerCLI, Hyper-V). The rule monitors for specific process executions (esxcli, vim-cmd, powershell) that involve administrative VM actions such as creating or starting virtual machines, which may indicate malicious VM orchestration, data destruction, or persistence attempts in virtualized environments.
Detects the execution of sensitive ESXi administrative commands (e.g., esxcli, vim-cmd) that suggest potential hypervisor management or tampering, especially when initiated by non-administrative processes or specific shells.
Detects attempts to clone or snapshot sensitive virtual machines (such as Domain Controllers, PKI, Vault, ADFS, or SSO servers) in a VMware environment. The rule alerts on these activities when performed by non-administrator accounts outside of established maintenance windows, suggesting potential unauthorized data staging or credential extraction.
Detects the execution of remote commands on cloud virtual machines (Azure RunCommand or AWS SSM SendCommand) during defined off-hours (18:00 to 06:00). This rule identifies potentially unauthorized administrative or management activity occurring outside of standard business hours across cloud environments.
Page 4 of 9