Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
192 detections
Filters
Last updated
All Time
Detection languages
68
31
28
18
17
Contributors
79
31
29
13
7
Categories
83
48
48
30
25
Platforms
152
17
11
9
6
Products / Services
42
42
16
16
15
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
IDS Classtypes
10
6
1
IDS Protocols
16
This rule monitors for processes that repeatedly call GetTickCount64 while also invoking sleep functions, a common technique used by malware to detect virtualized environments or sandboxes by measuring time intervals and stalling execution to bypass short-duration automated analysis. The rule prioritizes alerts originating from non-standard system paths or processes.
This rule detects the DRAYN malware performing environment reconnaissance and sandbox evasion. It monitors for file access to the 'vmbusr.sys' driver, which is commonly used to identify virtual machine environments, followed by the execution of PowerShell commands to retrieve the system's UUID via Win32_ComputerSystem, a technique used for host fingerprinting.
Detects malware performing virtual machine or hypervisor detection checks
This rule detects potential sandbox evasion or environment analysis by identifying multiple disparate system checks (hardware, memory, processor, analysis tool, or uptime checks) performed within a short timeframe by common script interpreters like PowerShell or WScript/CScript.
Detects execution of specific malware samples identified as DcRAT that perform environment checks, such as timing analysis using GetTickCount64 and Sleep, combined with system configuration lookups to identify sandbox or analysis environments.
Modular remote access trojan associated with long-term espionage intrusions
Lightweight remote access trojan deployed in recruiter-themed social engineering
Rust-based macOS infostealer implant embedding prompt injection payloads
Form-grabbing and credential stealing malware-as-a-service
Rust-based ransomware family targeting enterprise environments
Detects Python-based execution of system binaries (wmic.exe, reg.exe, tasklist.exe, systeminfo.exe) used for environment reconnaissance, specifically targeting VM and sandbox detection artifacts characteristic of the SilentRunLoader malware.
Detects the execution of WMI queries or hidden PowerShell commands initiated by JScript/VBScript interpreters (wscript.exe/cscript.exe), a behavior characteristic of Kimsuky's NUKESPED loader for performing anti-analysis and sandbox evasion.
Detects suspicious processes attempting to query specific registry keys related to system locale settings (HKLM\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US). This behavior is characteristic of the Grixba infostealer performing geofencing or locale-based checks to determine if the environment is a target of interest.
Detects suspicious processes attempting to query specific registry keys related to system locale settings (HKLM\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US). This behavior is characteristic of the Grixba infostealer performing geofencing or locale-based checks to determine if the environment is a target of interest.
Detects reconnaissance activity associated with Pay2Key ransomware, specifically sandbox or environment checks. This includes process lineage originating from 7ZipSfx temporary directories combined with registry queries for S-1-5-19 (SYSTEM account) or direct file system access to Avast installation directories to verify the presence of security software.
Detects execution of a renamed pythonw.exe (userscreen.exe) from a suspicious location (Public\AccountPictures) that demonstrates short-lived execution characteristics indicative of a sandbox/VM evasion check, immediately followed by network connectivity to known NarwhalRAT C2 domains or pcloud infrastructure.
This rule detects suspicious activity indicative of virtualization or sandbox evasion. It looks for the loading of 'mpr.dll' in conjunction with specific registry keys related to VirtualBox ('HARDWARE\ACPI\DSDT\VBOX_'). Additionally, it identifies processes executing with command lines containing strings associated with Sandboxie ('sbiedll.dll'), network connection functions ('WNetAddConnection2W'), or queries for video controller information ('SELECT CurrentRefreshRate FROM Win32_VideoController'), which are often used by malware to detect analysis environments. The rule also correlates 'mpr.dll' and 'sbiedll.dll' loads within the same process.
Detects malware using excessively long sleep calls to outlast sandbox analysis time
Detects a behavioral pattern associated with CastleLoader's anti-analysis technique, where a process initiates a DNS query that fails (NXDOMAIN) and is immediately followed by a successful network connection to a different destination. This can indicate an attempt to check for sandboxing or sinkholing environments.
Detects STOCKSTAY .NET backdoor components (e.g., STOCKMARKET, STOCKTRADER) accessing their encrypted 'fonts' configuration files located in the local application data SMN directory. These components use environmental keying (hostname or domain-based) to decrypt the configuration, a technique designed to thwart analysis.
This rule detects potential Pony malware anti-sandbox evasion techniques by correlating WMI queries for virtual machine artifacts and registry reads for BIOS/VM strings with the termination of short-lived processes (less than 30 seconds). This behavior is indicative of malware attempting to determine if it's running in a sandbox environment and exiting if it detects one.
Page 6 of 10