Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
236 detections
Filters
Last updated
All Time
Detection languages
83
49
29
20
17
Contributors
91
31
26
26
9
Categories
109
70
37
36
36
Platforms
183
23
22
9
2
Products / Services
71
56
24
21
19
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
14
4
2
IDS Protocols
20
Correlates the stealer invoking system_profiler via osascript to search for virtualization strings to halt execution in sandboxes.
Detects the execution of QEMU virtualization binaries from non-standard or suspicious file paths (such as Temp or AppData) or with command-line arguments indicative of VM configuration (e.g., -drive, -net, -kernel). The rule further correlates these process executions with subsequent network connections within a 5-minute window, potentially identifying unauthorized VM usage, data exfiltration through tunnelled connections, or adversary-controlled virtualization tools.
Detects potential sandbox evasion behavior characteristic of OXLOADER malware. The rule identifies a non-system process dynamically loading 'mpr.dll' and terminating shortly thereafter (within 1 minute). This sequence is associated with anti-sandbox techniques where malware attempts to trigger an error (e.g., ERROR_BAD_NAME 0x43) via a malformed UNC path using 'WNetAddConnection2W' to detect if it is running within an analysis environment.
This rule detects the presence of a cluster of DLL names commonly associated with anti-analysis techniques used by malware, specifically Sprysocks. The DLLs 'snxhk.dll', 'SxWrapper.dll', 'SxIn.dll', 'SXIn64.dll', 'SbieDll.dll', and 'cmdvrt32.dll' are checked by malware loaders to identify sandbox or packet-capture environments. The rule triggers if at least three of these DLL names are found, indicating an attempt by malware to evade detection or analysis.
Correlates the stealer invoking system_profiler to search for virtualization or security strings (e.g., VMware, Parallels) to halt execution in sandboxes.
This rule monitors registry modifications for keys or values related to common virtualization platforms (VirtualBox, VMware, QEMU, Xen, Hyper-V). Such registry queries or modifications are often indicative of malware performing sandbox evasion to determine if the execution environment is a virtual machine or a sandbox used for analysis, allowing the malware to terminate or alter its behavior to avoid detection.
Detects PowerShell queries for motherboard serial numbers or UUIDs, behaviors commonly associated with malware reconnaissance and sandbox evasion. This rule specifically looks for 'powershell.exe' executing commands that query 'Win32_BaseBoard' or 'Win32_ComputerSystemProduct' and contain 'SerialNumber' or 'UUID'.
Detects Atlas RAT performing anti-analysis and sandbox evasion checks by querying the Windows Defender Application Guard (WDAG) RunOnce registry key. This behavior is associated with TA4922.
Detects PowerShell queries for motherboard serial numbers or UUIDs, behaviors commonly associated with malware reconnaissance and sandbox evasion. This rule specifically looks for 'powershell.exe' executing commands that query 'Win32_BaseBoard' or 'Win32_ComputerSystemProduct' and contain 'SerialNumber' or 'UUID'.
Detects the execution of the Restart-Computer cmdlet with the -Force flag via PowerShell, a technique used by a recent malware dropper to disrupt sandbox analysis.
This Suricata rule detects HTTP requests containing 'VBoxService' in the URI. This string is associated with VirtualBox Guest Additions, which are often installed in virtualized environments. The presence of such a string in network traffic can indicate that a system is a virtual machine, which attackers or malware might query to detect if they are running in a sandbox or virtualized analysis environment. This detection is categorized as 'trojan-activity' and is related to discovery tactics.
Detects Atlas RAT anti-analysis behavior by monitoring for interactions with the Windows Defender Application Guard (WDAG) RunOnce registry key. This is a known sandbox evasion technique used by TA4922 before executing its primary payload.
Detects Atlas RAT anti-analysis behavior by monitoring for registry queries or interactions with the Windows Defender Application Guard (WDAG) RunOnce registry key. This rule specifically looks for registry events where the key name contains "RunOnce" and the value name contains "WDAG", indicating an attempt by malware to detect or interact with a sandbox environment.
Detects registry interactions querying or accessing the Windows Defender Application Guard (WDAG) RunOnce registry key. This behavior is associated with Atlas RAT performing anti-sandbox and anti-analysis checks prior to payload execution.
Detects the execution of "system_profiler" with specific "Data Types" that have been seen being used by threat actors and malware. It provides system hardware and software configuration information.
This process is primarily used for system information discovery. However, "system_profiler" can also be used to determine if virtualization software is being run for defense evasion purposes.
This process is primarily used for system information discovery. However, "system_profiler" can also be used to determine if virtualization software is being run for defense evasion purposes.
Detects the execution of "sysctl" with specific arguments that have been used by threat actors and malware. It provides system hardware information.
This process is primarily used to detect and avoid virtualization and analysis environments.
This process is primarily used to detect and avoid virtualization and analysis environments.
Detects the execution of an osascript command that queries system_profiler for SPMemoryDataType and checks for virtualization software strings like QEMU or VMware. This technique is actively used by the Atomic macOS Stealer (AMOS) to evade automated analysis environments and sandboxes.
Detects the execution of `system_profiler` querying memory and hardware data types. Atomic Stealer (AMOS) utilizes these environmental awareness checks prior to execution to evade analysis by determining if it is running within a virtual machine environment.
Detects PowerShell commands checking for low system memory (specifically less than 3GB), a common anti-sandbox technique used by the DeadVax campaign to evade analysis environments.
Detects the PLASMAGRID implant and its modules by their SHA-256 hash values. The implant is the final payload of the Coruna exploit kit, designed to steal cryptocurrency and other financial information from compromised iOS devices.
This detection identifies the execution of a process from a directory that also contains a zero-byte file named 'pic1.png'. This specific behavior is a known execution guardrail for the 'Diaoyu' loader, used by the TGR-STA-1030 group to evade automated sandbox analysis.
Page 10 of 12