Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
192 detections
Filters
Last updated
All Time
Detection languages
68
31
28
18
17
Contributors
79
31
29
13
7
Categories
83
48
48
30
25
Platforms
152
17
11
9
6
Products / Services
42
42
16
16
15
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
10
6
1
IDS Protocols
16
Detects multiple concurrent attempts by a process to identify virtualization or analysis environments (sandbox evasion). The rule monitors for registry key lookups related to VMware/VirtualBox, as well as the execution of commands (via wmic, powershell, or tasklist) aimed at enumerating system information such as video controllers, boot times, operating system details, or process lists. An alert is generated when three or more distinct types of these checks are observed within a 60-second window by the same process, excluding administrative or system-level accounts.
Detects the execution of PowerShell with encoded commands originating from suspicious process paths (outside Windows or Program Files directories). The rule includes logic to identify potential sandbox evasion by correlating the PowerShell activity with subsequent tasklist.exe execution within a short window, often characteristic of malware performing environment checks.
Detects execution of a WMI query targeting Win32_VideoController to retrieve the CurrentRefreshRate property. This behavior is associated with the OXLOADER malware family, which uses this check to identify sandbox or virtualized environments (typically with refresh rates of 20Hz or lower) and abort execution to evade analysis.
Detects the loader deliberately dropping marker files when it identifies an analysis environment. This rule specifically looks for the creation of files named "vm.txt", "Debugger.txt", or "01_detect_analisse_process.txt", which are known indicators of malware attempting to detect virtualized or debugging environments.
Detects potential SNOWLIGHT dropper behavior where a process associated with Windows Update (wusvc.exe) is observed alongside environment naming conventions indicative of analysis sandboxes (e.g., 'malware', 'sandbox', 'virus', 'sample'). This combination of process naming and environment characterization suggests evasion or anti-analysis techniques typical of malware droppers.
This rule monitors registry modifications for keys or values related to common virtualization platforms (VirtualBox, VMware, QEMU, Xen, Hyper-V). Such registry queries or modifications are often indicative of malware performing sandbox evasion to determine if the execution environment is a virtual machine or a sandbox used for analysis, allowing the malware to terminate or alter its behavior to avoid detection.
Detects indicators of the DcRAT malware associated with Operation DragonReturn. The rule monitors for the creation of the specific DcRAT mutex 'Global\ShitSetupOn26126k', the execution of a malicious process disguised as the Windows Media Player 'Mixed Reality' utility, and the sideloading of the 'nvdaHelperRemote.dll' file within the Windows Media Player directory, which are techniques used for sandbox evasion and persistence.
Detects the OXLOADER malware attempting to probe for sandbox or analysis environments by dynamically loading mpr.dll and invoking the WNetAddConnection2W API function. This activity is a known behavioral pattern used to identify system artifacts or network connectivity constraints indicative of security analysis environments.
This rule detects the presence of a cluster of DLL names commonly associated with anti-analysis techniques used by malware, specifically Sprysocks. The DLLs 'snxhk.dll', 'SxWrapper.dll', 'SxIn.dll', 'SXIn64.dll', 'SbieDll.dll', and 'cmdvrt32.dll' are checked by malware loaders to identify sandbox or packet-capture environments. The rule triggers if at least three of these DLL names are found, indicating an attempt by malware to evade detection or analysis.
Detects the SilverFox loader performing sandbox and virtual machine evasion checks, including process enumeration (CreateToolhelp32Snapshot), heap pressure via VirtualAllocExNuma, and timing checks (QueryPerformanceCounter, NtAllocateVirtualMemoryApiCall). The detection focuses on specific process names and file paths associated with trojanized Panasonic/Philips OEM process contexts.
This rule detects attempts by a process, potentially a Remcos RAT loader identified by 'GST*.com' or 'GST' in its command line, to evade sandbox or virtual machine environments. It looks for the presence of common sandbox/VM indicators in the command line.
This rule monitors registry modifications for keys or values related to common virtualization platforms (VirtualBox, VMware, QEMU, Xen, Hyper-V). Such registry queries or modifications are often indicative of malware performing sandbox evasion to determine if the execution environment is a virtual machine or a sandbox used for analysis, allowing the malware to terminate or alter its behavior to avoid detection.
Hunts for the IAT_PHANTOM_FIX evasion routine where Python generates thousands of SHA-512 hashes to delay execution and fool heuristics. This rule specifically looks for 'python.exe' processes executing command lines that contain a loop iterating a large number of times (at least 1000) and performing SHA-512 hashing, indicative of anti-analysis techniques used by malware like XWorm.
Detects malware checking for user activity to detect sandbox environments
This rule detects attempts by a process, potentially a Remcos RAT loader identified by 'GST*.com' or 'GST' in its command line, to evade sandbox or virtual machine environments. It looks for the presence of common sandbox/VM indicators in the command line.
Detects malware checking for user activity to detect sandbox environments
This Suricata rule detects HTTP requests containing 'VBoxService' in the URI. This string is associated with VirtualBox Guest Additions, which are often installed in virtualized environments. The presence of such a string in network traffic can indicate that a system is a virtual machine, which attackers or malware might query to detect if they are running in a sandbox or virtualized analysis environment. This detection is categorized as 'trojan-activity' and is related to discovery tactics.
Detects the creation of a child process by a known analysis, debugging, or reverse engineering tool. Malware like Stealit checks for these parent processes to determine if it's being analyzed. Spawning unexpected child processes from these tools can indicate malicious activity, such as the malware continuing its execution path after a failed anti-analysis check or a user interacting with a malicious file within a sandbox. The rule is filtered to exclude common legitimate child processes spawned by these tools.
This query searches for multiple indicators associated with the STAC4713 and STAC3725 campaigns (often linked to PayoutsKing/GOLD ENCOUNTER). It utilizes a fast free-text pre-filter followed by a case statement to categorize specific TTPs, including QEMU abuse, rogue scheduled tasks, suspicious services/accounts, covert tunneling, and credential access.
This rule detects potential persistence mechanisms used by the AMOS malware on macOS systems. Specifically, it looks for the creation or execution of a launch daemon named 'com.finder.helper' in conjunction with other suspicious activities such as the execution of '.agent' or '.mainhelper' files, or commands used for user context pivoting . The rule also includes checks for VM detection attempts using 'system_profiler'. This combination of activities indicates a high likelihood of AMOS malware establishing persistence and attempting to escalate privileges or gather system information.
Detects the Golang Sliver dropper or its associated opsec.log file. This malware leverages an LLM (GPT-4) to evaluate system telemetry before deploying its payload.
Page 8 of 10