Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
60 detections
Filters
Last updated
All Time
Detection languages
18
11
7
7
5
Contributors
26
11
5
3
3
Categories
36
30
14
10
6
Platforms
52
5
1
1
Products / Services
26
12
9
6
5
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
1
IDS Classtypes
4
1
IDS Protocols
4
Detects execution of processes associated with Millenium RAT that contain specific strings indicating sandbox evasion techniques, including environment checks and stalling loops (Thread.Sleep/MemoryInfoDetector) used to bypass automated analysis.
Detects sandbox evasion behavior linked to the Operation DragonReturn DcRAT loader. The malware uses the GetTickCount64 API in a tight loop with Sleep(1) calls to identify and detect sandbox environments that accelerate system time. The rule monitors for the suspicious execution of specific executables and subsequent process injection into svchost.exe.
Detects Pay2Key ransomware attempting sandbox evasion by executing the Windows timeout utility with a 10-second delay, initiated from the SysWOW64 command prompt.
Detects the execution of a malicious PowerShell loader associated with the UAC-0226 threat actor. The loader employs a 60-second sleep delay using the Start-Sleep cmdlet to evade automated sandbox analysis before proceeding to reflectively load the GIFTEDCROOK payload from a file located in C:\ProgramData\WC3.
This rule identifies potentially malicious activity where a process, which has been dormant on the system for at least 7 days since its initial start, suddenly performs a high volume (more than 50 events in 60 seconds) of file creation or modification events. This behavior pattern is often indicative of ransomware encryption activities, where malware lies dormant before initiating a rapid, destructive encryption cycle.
Detects registry SetValue events targeting Chrome, Edge, or Chromium extension storage keys by processes not associated with official browser updaters or installers. This rule identifies the initialization phase of StegoAd malware (associated with the DarkSpectre campaign), where a first-run timestamp is written to the registry to establish a 3-5 day dormancy period before the extension activates its steganographic payload retrieval functionality.
This rule detects potential sandbox evasion or environment analysis by identifying multiple disparate system checks (hardware, memory, processor, analysis tool, or uptime checks) performed within a short timeframe by common script interpreters like PowerShell or WScript/CScript.
Detects processes that execute and remain dormant for more than 120 seconds before performing a high volume of file operations (greater than 50) or initiating a high volume of network connections (greater than 20). This pattern is consistent with malware or beaconing implants attempting to evade detection during automated sandbox analysis.
Detects the Kimsuky NUKESPED JSE loader anti-analysis pattern. The rule monitors for wscript.exe executing a JSE file, followed by a delayed PowerShell execution containing hidden window flags, decoding or non-interactive flags, and references to ProgramData, which is consistent with sandbox evasion and NUKESPED payload staging.
Detects malware using excessively long sleep calls to outlast sandbox analysis time
Detects the execution of PowerShell or Windows script hosts containing a combination of WMI system enumeration queries (specifically targeting Win32_ComputerSystem) and common virtual machine/sandbox environment artifacts (vmware, vbox, sandbox). This behavior is consistent with the Gamaredon group's PteroSand malware performing environment fingerprinting to identify analysis environments and abort execution.
Detects the use of common scripting engines (PowerShell, WScript, CScript, MSHTA) to perform system fingerprinting, sandbox detection, or execution timing delays. This activity is often indicative of early-stage malware or reconnaissance tools attempting to identify if they are running in a virtual or analysis environment before proceeding with malicious activity.
Detects execution of system discovery and evasion commands commonly used by the Gamaredon group's Ptero-family tooling. The rule monitors for mshta.exe, wscript.exe, or cscript.exe spawning wmic, powershell, or cmd to execute queries related to virtualization artifacts (e.g., VirtualBox, VMware) or time-based evasion (e.g., Start-Sleep).
Detects sandbox evasion techniques employed by the Gamaredon group using their PteroSand methodology. The rule monitors for WMI queries executed by suspicious parent processes to identify virtualization artifacts (VMware, VirtualBox) or system hardware/system information, which are characteristic of environment reconnaissance and timing-based checks prior to payload activation.
Detects a behavioral pattern associated with CastleLoader's anti-analysis technique, where a process initiates a DNS query that fails (NXDOMAIN) and is immediately followed by a successful network connection to a different destination. This can indicate an attempt to check for sandboxing or sinkholing environments.
This rule detects potential Pony malware anti-sandbox evasion techniques by correlating WMI queries for virtual machine artifacts and registry reads for BIOS/VM strings with the termination of short-lived processes (less than 30 seconds). This behavior is indicative of malware attempting to determine if it's running in a sandbox environment and exiting if it detects one.
Detects sandbox evasion techniques used by the Gamaredon group's PteroSand malware. The rule monitors for WMI queries against system artifacts (Win32_ComputerSystem, Win32_BIOS, or Win32_VideoController) searching for virtualization-related strings (vmware, vbox, etc.), followed by a mandatory sleep/timeout delay of at least 60 seconds, and concludes by identifying the subsequent execution of a new process within the same lineage.
Detects processes that execute and remain dormant for more than 120 seconds before performing a high volume of file operations (greater than 50) or initiating a high volume of network connections (greater than 20). This pattern is consistent with malware or beaconing implants attempting to evade detection during automated sandbox analysis.
Detects processes that execute and remain dormant for more than 120 seconds before performing a high volume of file operations (greater than 50) or initiating a high volume of network connections (greater than 20). This pattern is consistent with malware or beaconing implants attempting to evade detection during automated sandbox analysis.
This rule detects activities associated with the Kimsuky NUKESPED malware loader, including the execution of malicious .jse scripts, PowerShell-based obfuscated payload decoding using 'ProgramData' as a staging path, and the subsequent execution of the 'zlrenu8.exe' payload. The rule specifically targets the multi-stage infection chain where scripts are used to perform anti-analysis and sandbox evasion before launching the primary malicious component.
This rule detects two suspicious behaviors associated with the TinyRCT malware family: the execution of common installer or archiver utilities in the Downloads folder that terminate within two seconds, and the use of 'choice.exe' for self-deletion of an executing process within a short timeframe.
Page 2 of 3