Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
192 detections
Filters
Last updated
All Time
Detection languages
68
31
28
18
17
Contributors
79
31
29
13
7
Categories
83
48
48
30
25
Platforms
152
17
11
9
6
Products / Services
42
42
16
16
15
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
10
6
1
IDS Protocols
16
Detects the Bumblebee loader by identifying a hardcoded list of CIS-region locale strings within the file, used in conjunction with 'GetSystemDefaultLocaleName' and 'ExitProcess' to perform an anti-analysis kill switch, terminating execution if the infected system is located in a Commonwealth of Independent States (CIS) region.
Latin American banking trojan using DLL side-loading and overlay attacks
Loader malware delivering follow-on ransomware payloads
Detects the BQT/start.exe loader exhibiting suspicious behavior indicative of sandbox or analysis environment evasion, including checking for common analysis tools, enumerating processes, or querying the registry for VMware-related artifacts.
This rule detects the creation, modification, or startup of virtual machines using common administrative tools such as PowerShell (Hyper-V), vmrun (VMware), VBoxManage (VirtualBox), and vSphere CLI tools. Such activities can be indicators of adversary efforts to create hidden virtual environments, stage malicious payloads, or perform unauthorized administrative actions on virtualized infrastructure.
Form-grabbing and credential stealing malware-as-a-service
Ransomware group exploiting edge devices and managed file transfer software
Ransomware group exploiting edge devices and managed file transfer software
Detects various pre-execution and environment fingerprinting behaviors indicative of the Grandoreiro banking trojan. This includes WMI-based security product enumeration, execution of unsigned payloads from suspicious AppData paths, detection of security analysis/debugging tools, virtualization environment checks, and C2 communication attempts via geolocation services.
This rule detects known evasion techniques used by the Pay2Key and Grixba malware families. It identifies timing-based delays triggered by malicious 'ping.exe' commands targeting invalid IP addresses and locale-based geofencing checks performed via registry queries for custom locale settings.
Detects behavior consistent with the Vidar/Wingo loader, part of Operation Turb00, where a process probes for VM/sandbox artifacts, specifically the VMware Tools daemon path and WMI ETW restrictions registry keys, followed by a rapid process termination characteristic of sandbox evasion.
Detects execution of processes associated with Millenium RAT that contain specific strings indicating sandbox evasion techniques, including environment checks and stalling loops (Thread.Sleep/MemoryInfoDetector) used to bypass automated analysis.
Detects sandbox evasion behavior linked to the Operation DragonReturn DcRAT loader. The malware uses the GetTickCount64 API in a tight loop with Sleep(1) calls to identify and detect sandbox environments that accelerate system time. The rule monitors for the suspicious execution of specific executables and subsequent process injection into svchost.exe.
Detects the execution of the TinyRCT backdoor, which attempts to masquerade as the legitimate PerfWatson2.exe binary. The detection focuses on the process running from the AppData/Local directory, a common location for user-level malicious payloads.
Detects the execution of the VSCode npm infostealer campaign, specifically identifying the usage of a fake eslint loader named 'vscode-eioesocxetd.js'. This malware performs sandbox and environment checks for CI/CD, cloud, and containerized environments (AWS, Azure, GCP, GitHub Codespaces, etc.) to evade analysis before proceeding to deploy infostealers or backdoors.
Campaign converting compromised FortiGate firewalls into credential stealers
AI-powered phishing-as-a-service abusing device-code authentication
Banking trojan and loader using malicious Office macro delivery
Rust-based ransomware family targeting enterprise environments
Detects the Glove Stealer (Yuta) payload, identified as winupdate.exe, performing registry queries for virtual machine artifacts such as VMware, VirtualBox, or QEMU strings. This is a common sandbox evasion technique to determine if the malware is running in an analysis environment.
Detects long-running WScript or CScript processes executing script files (ending in .js or .jse) that perform environment enumeration via WMI queries (e.g., Win32_ComputerSystem, Win32_BIOS, Win32_VideoController). This behavior is often indicative of automated sandbox evasion and reconnaissance performed by malicious scripts or droppers.
Page 5 of 10