Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
192 detections
Filters
Last updated
All Time
Detection languages
68
31
28
18
17
Contributors
79
31
29
13
7
Categories
83
48
48
30
25
Platforms
152
17
11
9
6
Products / Services
42
42
16
16
15
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
10
6
1
IDS Protocols
16
Detects PowerShell execution using Get-CimInstance to query Win32_ComputerSystem, Win32_BIOS, Win32_BaseBoard, or other WMI classes commonly checked by malware to detect virtual machine or sandbox environments. This technique is frequently used by malware families to evade analysis in virtualized security research environments.
Pulsar RAT is a derivative of Quasar RAT with extensive functionality including keylogging, cryptocurrency wallet clipping, credential theft, file management, remote shell execution, and data exfiltration capabilities. As a modular, open-source remote administration tool designed for Windows systems, Pulsar introduces significant enhancements over its predecessor.
Detects a defense evasion technique used by CHAMELEON#NET where the malware introduces significant delays using multiple 'ping 127.0.0.1 -n <number> > nul' commands chained together. This tactic is designed to bypass automated sandbox analysis by exceeding typical execution timeouts.
Detects a process changing a memory region's permissions to be readable, writable, and executable (RWX). This is highly suspicious and is often associated with malware unpacking, process hollowing, or self-modifying code. The APT29 group has been observed using a backdoor (VMTOOLS.DLL) that employs self-modifying code to evade static analysis.
Detects the execution of specific system commands used by the DigitStealer malware for anti-analysis and evasion. This includes checks for virtualization, hardware features (specifically on Apple Silicon), and system locale.
This rule detects PowerShell scripts attempting to identify a virtualization or sandbox environment. It specifically looks for the use of WMI objects like 'MSAcpi_ThermalZoneTemperature' and 'Win32_ComputerSystem' in PowerShell script block text, which are commonly queried by malware to determine if it's running in a virtualized environment.
Detects the creation of a child process by a known analysis, debugging, or reverse engineering tool. Malware like Stealit checks for these parent processes to determine if it's being analyzed. Spawning unexpected child processes from these tools can indicate malicious activity, such as the malware continuing its execution path after a failed anti-analysis check or a user interacting with a malicious file within a sandbox. The rule is filtered to exclude common legitimate child processes spawned by these tools.
Detects PhantomVAI Loader and its common payload, Katz Stealer. PhantomVAI is a .NET loader known for delivering various infostealers and uses VM detection techniques. Katz Stealer is an infostealer notable for its anti-CIS country checks to evade analysis.
Detects a sequence of commands associated with the anti-analysis techniques of the Stealit malware. Stealit executes specific wmic and tasklist commands in quick succession from a single parent process to check for debuggers, analysis tools, and virtual environments.
This analytic detects instances where Chromium-based browsers (e.g., Google Chrome, Microsoft Edge, Brave, Opera, Vivaldi) are launched with the `--user-data-dir` command-line argument, combined with `--disable-gpu` or `--disable-3d-apis`. While `--user-data-dir` is a legitimate flag for multi-profile support or automation, its use alongside GPU/3D API disabling flags is frequently observed in malware and adversary tactics. This combination can indicate an attempt to run the browser in an isolated, potentially stealthy environment for activities such as credential harvesting, phishing delivery, or evasion of user session artifacts and analysis.
Geofenced Ru
Sigma
Detect region and exit if matched with harcoded country list Get-UICulture).Name -match "CN|RO|RU|UA|BY
AntiVM
Sigma
Detect virtual environment "VirtualBox|VMware|KVM|HVM"
Detects network requests to common IP geolocation services, such as 'ip-api.com/json'. This is a known anti-analysis technique used by malware, including a loader associated with the Silver Fox APT group, to determine if it is running in a research or sandbox environment by checking the public IP address, ISP, and organization.
Detects defense evasion tactics used by UpCrypter, such as checking for forensic tools or sandbox environments.
This rule detects activities associated with the RomCom threat group, including exploitation of CVE-2025-8088 (WinRAR path traversal), COM hijacking for persistence, anti-analysis techniques (RecentDocs check), C2 communication, and suspicious WMIC execution, potentially linked to a Mythic agent.
Detects suspicious activities related to CVE-2025-8088 WinRAR exploitation, including malicious file creation, COM hijacking, C2 communication, and anti-analysis techniques. Enhanced with ADS detection, command-line analysis, and refined false positive handling. This threat is now attributed to RomCom.
This detection rule identifies processes that call the 'GlobalMemoryStatusEx' Windows API. This behavior is a known sandbox evasion technique used by malware, including SLOW#TEMPEST, to check the system's physical memory size before executing a malicious payload. The rule is tuned to focus on unsigned processes or those running from non-standard locations and with low host prevalence.
KQL Query
This analytic detects instances where a Chrome or Chromium-based browser is launched with the `--no-sandbox` flag. This flag disables the browser's built-in security sandbox, which is a known indicator of potentially malicious or suspicious behavior. While occasionally used for development or testing, it is rarely seen in normal user activity. Threat actors often abuse this setting to execute malicious code, escape browser isolation, or for command and control, credential theft, or UI spoofing, especially when embedded in malware droppers or loaders. Investigation should focus on events originating from unusual parent processes (e.g., powershell.exe, cmd.exe, or unknown binaries) or accompanied by other suspicious activities.
Snip3 is a family of related remote access trojans. Although the malware in this family contain numerous small variations, they all exhibit similar behaviors and techniques.
The following query looks for a function call to a method named DetectSandboxie. This method is used in RevengeRAT and AsyncRAT instances involved in a campaign targeting the aviation industry, first observed in 2021. It has also been associated in the past other malware, such as WannaCry and QuasarRAT. Individual PowerShell functions can be detected in the same way in some instances, though care should be taken to ensure that the command name is unique -- otherwise, this query may return many false positives.
The following query looks for a function call to a method named DetectSandboxie. This method is used in RevengeRAT and AsyncRAT instances involved in a campaign targeting the aviation industry, first observed in 2021. It has also been associated in the past other malware, such as WannaCry and QuasarRAT. Individual PowerShell functions can be detected in the same way in some instances, though care should be taken to ensure that the command name is unique -- otherwise, this query may return many false positives.
This rule detects the execution of the 'sysctl' command on macOS with specific arguments ('hw.', 'kern.', or 'machdep.'). Threat actors and malware commonly use 'sysctl' with these arguments to gather system hardware information, often as part of virtualization or sandbox evasion techniques. By querying system properties, adversaries can determine if they are operating in an analysis environment and adjust their behavior accordingly.
Page 9 of 10