Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
192 detections
Filters
Last updated
All Time
Detection languages
68
31
28
18
17
Contributors
79
31
29
13
7
Categories
83
48
48
30
25
Platforms
152
17
11
9
6
Products / Services
42
42
16
16
15
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
10
6
1
IDS Protocols
16
Detects spinning up of virtual machines to conduct malicious activity in isolation
Detects the Windows Update service (wusvc.exe) or any process with environment strings (command line or folder path) containing sandbox-related keywords such as 'sandbox', 'malware', 'virus', or 'sample'. This behavior is characteristic of malware attempting to detect if it is running within an analysis, sandbox, or virtual machine environment.
Detects the SNOWLIGHT dropper (associated with UNC5221) attempting to evade analysis. The rule monitors for the loading of 'verifier.dll' by the suspicious 'wusvc.exe' process (a common disguise for this malware) as a mechanism to perform debugger checks, alongside the enumeration of various security and analysis tools (e.g., debuggers, packet sniffers, and virtualization tools).
Detects the execution of PowerShell commands that query system hardware and environment configurations often used by malware for sandbox detection, virtualization identification, or anti-analysis checks. The rule looks for queries related to VM guest tools (VMware, VirtualBox), BIOS/BaseBoard information, CPU core counts, total memory, and environment variables related to sandbox artifacts.
USB worm and loader leveraging living-off-the-land binaries
Infostealer-as-a-service targeting browser credentials and crypto wallets
Cloud extortion group exploiting exposed credentials and storage
Banking trojan and loader using malicious Office macro delivery
Loader malware delivering follow-on ransomware payloads
Detects the Yuta/Glove Stealer malware (winupdate.exe) performing environment checks by querying Windows registry keys associated with virtualization software (VMware, VirtualBox, QEMU). This behavior is indicative of sandbox evasion techniques used to detect analysis environments before executing secondary payloads.
This rule identifies suspicious activity associated with PyInstaller-packaged executables (specifically 'BQT.exe' and 'start.exe'). It detects these processes directly, or any processes that initiate them while referencing anti-analysis markers like debugger checks ('IsDebuggerPresent'), internal PyInstaller environment variables, or specific path markers like '_MEIPASS'. This behavior is characteristic of malware attempting to evade sandbox or manual analysis.
macOS malware used by JINX-0164 against cryptocurrency developers
Detects the execution of QEMU virtualization software by a SYSTEM user account with command-line arguments referencing specific file indicators (e.g., custom.qcow2, vault.db). This behavior is often indicative of an adversary using virtualization to run malicious tools, bypass security controls, or interact with sensitive data in an isolated environment.
Detects the BQTLock ransomware loader (start.exe) spawning the primary payload (BQT.exe), which subsequently executes WMIC to perform hardware, virtualization, and sandbox environment enumeration, a technique commonly used for evasion.
Detects behaviors associated with ransomware attempting to evade sandbox or virtual machine environments. This rule specifically looks for checks against the 'OOBEInProgress' and 'SystemSetupInProgress' registry values under '\Registry\Machine\System\Setup', and the presence of '_CLUSTER_NETWORK_NAME_' in process command lines. These checks are often performed by malware, such as Reynolds ransomware, to determine if it is running in an analysis environment before proceeding with malicious activities like encryption.
This rule monitors for processes with suspicious file names (specifically identified as potential obfuscated binaries) that perform API calls to 'GetTickCount64' associated with sandbox evasion techniques such as environment detection, debugger checking, and memory inspection.
This rule detects various behaviors associated with the LegionLoader malware, including suspicious process execution (msiexec/cmd spawning cmd/rundll32/dllhost via AppData), anti-debugging API calls (IsDebuggerPresent, SetUnhandledExceptionFilter), and specific registry modifications targeting Internet Explorer security settings used for sandbox evasion.
Detects suspected sandbox evasion techniques commonly utilized by BeepRAT malware. The rule monitors for WMI queries related to hardware/OS virtualization artifacts (e.g., CIM_Memory, Win32_OperatingSystem), registry enumeration of virtualization keys (VMware/VirtualBox), and suspicious child process spawning of wmiprvse.exe by known loader components (HFY.exe, tcc.exe, LuaJit.exe).
Detects registry queries for common virtualization-related artifacts (e.g., VMware, VirtualBox) performed by specific suspicious processes. This behavior is indicative of sandbox or virtual machine evasion techniques used by malware to detect if it is running in an analysis environment before executing its malicious payload.
This rule detects registry activity that indicates the presence of a virtualization or sandbox environment. Malware often checks for such environments to evade analysis. The rule specifically looks for registry keys and values associated with VMware and VirtualBox.
Detects payloads that check domain membership before executing
Page 7 of 10