Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
236 detections
Filters
Last updated
All Time
Detection languages
83
49
29
20
17
Contributors
91
31
26
26
9
Categories
109
70
37
36
36
Platforms
183
23
22
9
2
Products / Services
71
56
24
21
19
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
14
4
2
IDS Protocols
20
Detects the creation of a zero-byte 'pic1.png' file alongside an executable in the same directory, a TTP associated with the Diaoyu Loader's anti-sandbox integrity check. This behavior indicates an attempt to evade detection by verifying the execution environment.
Detects PowerShell execution using Get-CimInstance to query Win32_ComputerSystem, Win32_BIOS, Win32_BaseBoard, or other WMI classes commonly checked by malware to detect virtual machine or sandbox environments. This technique is frequently used by malware families to evade analysis in virtualized security research environments.
Detects PowerShell scripts that query the system's total physical memory and compare it against common low-resource thresholds (e.g., < 4GB). This is a known sandbox evasion technique used by malware to identify and avoid analysis environments, which are often configured with limited RAM.
Detects the PREYHUNTER 'watcher' module performing anti-analysis checks by launching common security, forensic, or shell tools.
Detects the execution of a Python interpreter with suspicious characteristics, such as running from a temporary location or using command-line arguments associated with obfuscation and in-memory execution. This behavior is consistent with Python-based stealers like Xillen Stealer.
Detects the execution of specific system commands used by the DigitStealer malware for anti-analysis and evasion. This includes checks for virtualization, hardware features (specifically on Apple Silicon), and system locale.
Detects the execution of `sysctl` commands querying for specific Apple Silicon M2+ hardware features. This behavior is used by the DigitStealer malware for anti-analysis purposes to evade detection and target specific hardware.
Detects behaviors associated with AMOS and Odyssey Stealer, including using osascript to perform anti-analysis checks via system_profiler and terminating OneDrive services to impair defenses.
This rule detects PowerShell scripts attempting to identify a virtualization or sandbox environment. It specifically looks for the use of WMI objects like 'MSAcpi_ThermalZoneTemperature' and 'Win32_ComputerSystem' in PowerShell script block text, which are commonly queried by malware to determine if it's running in a virtualized environment.
Detects PhantomVAI Loader and its common payload, Katz Stealer. PhantomVAI is a .NET loader known for delivering various infostealers and uses VM detection techniques. Katz Stealer is an infostealer notable for its anti-CIS country checks to evade analysis.
Detects a sequence of commands associated with the anti-analysis techniques of the Stealit malware. Stealit executes specific wmic and tasklist commands in quick succession from a single parent process to check for debuggers, analysis tools, and virtual environments.
This rule detects various activities associated with the InterLock Ransomware (UNC5774). It identifies anti-VM checks performed via PowerShell, specifically looking for commands that query for QEMU, memory less than 4GB or 1.5GB, or specific desktop naming conventions. It also detects local group and Service Principal Name (SPN) enumeration using PowerShell cmdlets like 'Get-LocalGroupMember', 'Get-LocalGroup', or ADSI queries for 'samAccountName' and 'servicePrincipalName'. Persistence mechanisms are covered by monitoring registry Run/RunOnce keys for entries that launch 'node' or 'php' executables. Furthermore, the rule looks for suspicious staging of 'node.exe' or 'php.exe' within the AppData\Roaming directory when initiated by PowerShell processes. The rule leverages 'DeviceProcessEvents', 'DeviceRegistryEvents', and 'DeviceEvents' (specifically PowerShellCommand action type) to capture these activities.
Detects HijackLoader attempting to perform anti-virtual machine (VM) checks by querying for VirtualBox-specific registry keys from a PowerShell process that also initiates a network connection. This combination of behaviors is indicative of sandbox evasion.
Detects network requests to common IP geolocation services, such as 'ip-api.com/json'. This is a known anti-analysis technique used by malware, including a loader associated with the Silver Fox APT group, to determine if it is running in a research or sandbox environment by checking the public IP address, ISP, and organization.
Detects components of the KimJongRAT PE variant, including the orchestrator (NetworkService.dll), loader (sys.dll/baby.dll), and stealer (dwm.dll), based on unique strings, PDB paths, and network communication artifacts.
This detection rule identifies processes that call the 'GlobalMemoryStatusEx' Windows API. This behavior is a known sandbox evasion technique used by malware, including SLOW#TEMPEST, to check the system's physical memory size before executing a malicious payload. The rule is tuned to focus on unsigned processes or those running from non-standard locations and with low host prevalence.
Detects initial execution patterns and stealer activities used by KimJongRAT PE and PowerShell variants, including LNK/HTA execution, certutil decoding, rundll32 execution, and PowerShell-based data collection.
Goal: Find machines in the last N days where the SystemGuardSecurityLevel value NOW is less than it was BEFORE.
Step 1: Get a list of all security levels in the system where the level is not null.
Step 1: Get a list of all security levels in the system where the level is not null.
This analytic detects instances where a Chrome or Chromium-based browser is launched with the `--no-sandbox` flag. This flag disables the browser's built-in security sandbox, which is a known indicator of potentially malicious or suspicious behavior. While occasionally used for development or testing, it is rarely seen in normal user activity. Threat actors often abuse this setting to execute malicious code, escape browser isolation, or for command and control, credential theft, or UI spoofing, especially when embedded in malware droppers or loaders. Investigation should focus on events originating from unusual parent processes (e.g., powershell.exe, cmd.exe, or unknown binaries) or accompanied by other suspicious activities.
Snip3 is a family of related remote access trojans. Although the malware in this family contain numerous small variations, they all exhibit similar behaviors and techniques.
The following query looks for a function call to a method named DetectSandboxie. This method is used in RevengeRAT and AsyncRAT instances involved in a campaign targeting the aviation industry, first observed in 2021. It has also been associated in the past other malware, such as WannaCry and QuasarRAT. Individual PowerShell functions can be detected in the same way in some instances, though care should be taken to ensure that the command name is unique -- otherwise, this query may return many false positives.
The following query looks for a function call to a method named DetectSandboxie. This method is used in RevengeRAT and AsyncRAT instances involved in a campaign targeting the aviation industry, first observed in 2021. It has also been associated in the past other malware, such as WannaCry and QuasarRAT. Individual PowerShell functions can be detected in the same way in some instances, though care should be taken to ensure that the command name is unique -- otherwise, this query may return many false positives.
Adversaries may employ various system checks to detect and avoid virtualization and analysis environments.
This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox
This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox
Page 11 of 12