Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
192 detections
Filters
Last updated
All Time
Detection languages
68
31
28
18
17
Contributors
79
31
29
13
7
Categories
83
48
48
30
25
Platforms
152
17
11
9
6
Products / Services
42
42
16
16
15
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
10
6
1
IDS Protocols
16
Detects rapid, repetitive queries to system hardware identifiers (DMI, CPU info, virtualization attributes) commonly used by adversaries for reconnaissance or environment awareness (sandbox detection). The rule identifies suspicious behavior by tracking the execution of commands like 'cat', 'grep', or 'dmidecode' that target sensitive Linux system files (e.g., /sys/devices/virtual/dmi/id/*, /proc/cpuinfo) when performed by non-standard parent processes in a short time window.
Detects rapid, repetitive queries to system hardware identifiers (DMI, CPU info, virtualization attributes) commonly used by adversaries for reconnaissance or environment awareness (sandbox detection). The rule identifies suspicious behavior by tracking the execution of commands like 'cat', 'grep', or 'dmidecode' that target sensitive Linux system files (e.g., /sys/devices/virtual/dmi/id/*, /proc/cpuinfo) when performed by non-standard parent processes in a short time window.
Detects rapid, repetitive queries to system hardware identifiers (DMI, CPU info, virtualization attributes) commonly used by adversaries for reconnaissance or environment awareness (sandbox detection). The rule identifies suspicious behavior by tracking the execution of commands like 'cat', 'grep', or 'dmidecode' that target sensitive Linux system files (e.g., /sys/devices/virtual/dmi/id/*, /proc/cpuinfo) when performed by non-standard parent processes in a short time window.
Detects a specific evasion behavior associated with the NinjaMare malware, where a process idles for at least 7 minutes before moving its window to off-screen coordinates during automated mouse or keystroke input, followed by restoring the window to its original position.
Detects a specific evasion behavior associated with the NinjaMare malware, where a process idles for at least 7 minutes before moving its window to off-screen coordinates during automated mouse or keystroke input, followed by restoring the window to its original position.
Detects sandbox/VM fingerprinting via combined Win32_DiskDrive and Win32_VideoController WMI queries from the same process/host within a short window — anti-analysis behavior observed in the ACRStealer AutoIt payload prior to execution.
Detects POST requests to the Storm-2755 Payroll Pirates AiTM toolkit fingerprinting endpoint URI pattern co-occurring with the distinctive openresty/PHP response header combination.
Detects creation of a mutex matching Abyssos's Global\[UUID4]_Admin/_User single-instance naming convention, or the specific known hardcoded mutex GUID.
Correlates a GetUserDefaultUILanguage locale check with subsequent deletion of a known-malicious scheduled task (MicroUpdaterV1, GoogleUpdateService, or MSEdgeUpdateService) and its install directory within a 5-minute window, consistent with DeviceManager's CIS-locale sandbox/analyst evasion self-cleanup routine.
Detects the loading of 'tempdir.dll', a module identified as implementing an anti-VM/sandbox gate. This mechanism queries DXGI adapter vendor IDs (e.g., QEMU 0x1234, VMware 0x15AD), checks for low VRAM allocation, and performs compute shader timing analysis to detect virtualization or sandbox environments prior to secondary payload execution.
Detects processes attempting to enumerate common CI/CD environment variables, a technique observed in the SleeperGem supply chain attack used for sandbox evasion and environment awareness to determine if the malware is running in a CI/CD build environment.
Detects processes attempting to enumerate common CI/CD environment variables, a technique observed in the SleeperGem supply chain attack used for sandbox evasion and environment awareness to determine if the malware is running in a CI/CD build environment.
Detects a multi-stage network activity pattern characteristic of 'SourTrade' cloaking. The rule tracks an initial HTTP request with a referral to a known lookalike crypto/trading domain, followed by the fetching of a client-side JavaScript fingerprinting script, and finally, a subsequent HTTP response that appears to be a near-empty decoy page (used to mask malicious content from crawlers).
Detects creation of the lg.txt debug/failure log written by ChonkyChicken's filename-gating anti-sandbox check.
Detects a single Python process sequentially accessing all three sandbox/container-detection artifacts (.dockerenv, .containerenv, /proc/1/cgroup), the environment-fingerprinting technique used by the mrmustard stealer before executing its payload.
Detects the execution of systeminfo.exe or wmic.exe that terminates within 5 seconds. This behavior is indicative of automated environment or sandbox discovery techniques, often performed by malware loaders such as those associated with the Turb00 operation or similar campaigns to fingerprint the victim machine prior to executing malicious payloads.
Detects the execution of QEMU binary components (qemu-system-x86_64.exe, etc.) on Windows hosts when spawned by suspicious parent processes or with command-line arguments indicative of VM disk image handling or non-interactive execution. This behavior is used by threat actors to execute malicious payloads within a virtualized container to evade host-based EDR monitoring and security controls.
Detects the execution of BQTLock ransomware loader components (start.exe or BQT.exe) that contain embedded PyInstaller environment artifacts. The rule monitors for processes that incorporate specific environment variables associated with PyInstaller-packaged binaries, which are often used by this malware to detect debugger presence and sandbox environments before proceeding with its primary malicious functionality.
Detects browser processes (Edge or Chrome) connecting to known IP geolocation or fingerprinting services within 3-5 days after a new extension has been registered. This behavior is consistent with malicious browser extension 'dormancy gating' and environment fingerprinting techniques, often used by malware (such as StegoAd) to confirm they are running on a real user host before activating payloads.
This rule detects multiple behavioral indicators associated with malware deployment, including PyInstaller environment artifacts, reconnaissance via system utilities (wmic, tasklist), and suspicious process hollowing/stager chains (e.g., mshta/wscript/cscript invoking PowerShell followed by payload execution from temporary directories). These behaviors are often associated with loaders like BQTLock and Remcos.
This rule detects qemu-system processes acting as parents for known tunneling or network utility tools, or qemu-system instances explicitly configured with suspicious command-line parameters (e.g., tap, socket connect, virtio-net) indicative of covert command and control (C2) communication. This behavior is associated with threat actors using Alpine Linux virtual machines within QEMU to bypass host EDR visibility.
Page 4 of 10