Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
192 detections
Filters
Last updated
All Time
Detection languages
68
31
28
18
17
Contributors
79
31
29
13
7
Categories
83
48
48
30
25
Platforms
152
17
11
9
6
Products / Services
42
42
16
16
15
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
10
6
1
IDS Protocols
16
Detects a specific sandbox/analysis evasion pattern associated with the QUICAgent malware, which involves a tight hashing loop and a randomized 100-600ms delay occurring between process initiation and the first outbound network connection.
Detects PowerShell execution containing multiple command-line arguments indicative of environment discovery, such as checking system uptime, hardware specifications, or specific memory-related delays. These patterns are commonly used by malware to detect virtual machines, sandboxes, or analysis environments to alter execution or exit.
Detects the presence of specific debug log files ('nb_hook_dbg.txt', 'nb_sleep_dbg.txt', etc.) created within 'C:\WINDOWS\Temp\' by the PIVOTPIPE malware family. These artifacts are produced during the initialization of indirect syscall and sleep-mask evasion routines, serving as a proxy indicator for these stealthy execution techniques.
Detects execution of WMI or PowerShell queries by HTA, WScript, or CScript processes to gather system information such as OSLanguage, BIOS, or hardware identifiers. This behavior is indicative of environment-awareness checks used by the Casbaneiro/Ousaban banking trojan to identify sandbox or virtualization analysis environments before proceeding with the infection.
Detects executable files launched from torrent-related directories or parent processes that perform reconnaissance commands or registry queries indicative of sandbox or virtualization detection, a technique observed in the MovieReaper malware loader.
Detects Android APK files utilizing anti-analysis techniques associated with the RatHat malware family, including malformed AndroidManifest.xml structures with custom 0x9999 chunk headers, high-entropy/oversized manifest files, and obfuscated DEX bytecode markers designed to disrupt static analysis and decompilation tools.
Detects network activity associated with the GhostCode phishing campaign, which leverages themed pages (e.g., MailDashboard) and Cloudflare Turnstile to perform security bypass checks. The rules identify the initial access URI pattern, the presence of specific phishing content in the HTTP response, and the subsequent verification cookies used after the CAPTCHA solution.
This rule detects the presence of the 'antiSNG' flag in command-line arguments of newly created processes. This flag is specific to the configuration of Hannibal Stealer, which uses it to perform anti-analysis checks, likely related to geofencing or environmental detection to evade sandbox or security analyst investigation.
These rules detect behavioral patterns associated with GhostCode-style anti-analysis, including URI-based gate redirection (turnstile checks), automated client filtering (User-Agent scanning), and UI-based spoofing (tab title masquerading) often used to protect malicious infrastructure from automated analysis tools and bots.
Detects Android malware performing anti-debugging, anti-instrumentation, and environmental checks to evade analysis. The rule monitors for processes querying system properties, checking for debugging artifacts like TracerPid, attempting to locate Frida instrumentation agents, or identifying rooting/Xposed framework artifacts and emulator-specific files.
Detects execution of the MovieReaper initial loader, which employs specific anti-sandboxing and anti-analysis techniques. The detection relies on identified file hashes, as well as heuristic analysis of process filenames containing common media-related keywords in sensitive directories and command line arguments indicating the presence of Global mutexes.
Detects execution of the MovieReaper initial loader, which employs specific anti-sandboxing and anti-analysis techniques. The detection relies on identified file hashes, as well as heuristic analysis of process filenames containing common media-related keywords in sensitive directories and command line arguments indicating the presence of Global mutexes.
This rule detects network traffic originating from potential Casbaneiro or Ousaban malware that uses HTTP 302 redirects to redirect non-targeted IP addresses to Google or YouTube. This behavior is used as a geofencing and sandbox evasion technique to prevent security analysts and automated systems from seeing the actual malicious payload.
Detects Koktevrat Android RAT APK artifacts via obfuscated component class names (JyfNnJyj, GtVyayDo) and the Stage 2 package identifier com.kowo.ciligeci
Detects Koktevrat Android RAT APK artifacts via obfuscated component class names (JyfNnJyj, GtVyayDo) and the Stage 2 package identifier com.kowo.ciligeci
Detects the execution of standard Windows command-line utilities (cmd.exe, wmic.exe, powershell.exe, fsutil.exe, vol.exe) used to query local volume information, such as name and serial number. This behavior is frequently associated with environment fingerprinting or sandbox evasion, particularly when executed by suspicious processes like mshta.exe as part of initial infection chains such as ClickFix payloads.
This rule detects PowerShell command lines that include .NET API calls typically used for anti-debugging and anti-analysis evasion, such as 'Debugger.IsAttached', 'Debugger.IsLogging', 'CheckRemoteDebuggerPresent', and 'Environment.FailFast'. These checks are common in malicious loaders and implants to determine if the process is being analyzed or monitored, allowing the malware to modify its behavior accordingly.
Detects the execution of the MovieReaper malware loader, which masquerades as 'msedge.exe' within the 'C:\ProgramData\Microsoft\Windows\Telemetry\' directory. This technique is used to bypass anti-sandbox checks by respawning as a legitimate-looking process in a persistent location after initial environment analysis is completed.
Detects network activity associated with the SilverFox relay dispatcher, including specific cache-busting URI patterns, C2 infrastructure hosted on Cloudflare Workers, and the delivery of decoy WeChat installer links.
Detects execution of the MovieReaper initial loader, which employs specific anti-sandboxing and anti-analysis techniques. The detection relies on identified file hashes, as well as heuristic analysis of process filenames containing common media-related keywords in sensitive directories and command line arguments indicating the presence of Global mutexes.
Detects execution of the MovieReaper initial loader, which employs specific anti-sandboxing and anti-analysis techniques. The detection relies on identified file hashes, as well as heuristic analysis of process filenames containing common media-related keywords in sensitive directories and command line arguments indicating the presence of Global mutexes.
Page 2 of 10