Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
60 detections
Filters
Last updated
All Time
Detection languages
18
11
7
7
5
Contributors
26
11
5
3
3
Categories
36
30
14
10
6
Platforms
52
5
1
1
Products / Services
26
12
9
6
5
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
1
IDS Classtypes
4
1
IDS Protocols
4
This rule monitors for processes with suspicious file names (specifically identified as potential obfuscated binaries) that perform API calls to 'GetTickCount64' associated with sandbox evasion techniques such as environment detection, debugger checking, and memory inspection.
Detects a process launched from an OpenClaw skill enumerating debugger, packet-capture, process-monitoring, sandbox, or virtual-machine utilities before payload execution. This behavior is indicative of malware attempting to identify analysis environments.
Detects the installation of a Microsoft Edge extension followed by an outbound network connection to known StegoAd C2 infrastructure after a 3-5 day dormancy period, a behavior characteristic of time-gated sandbox evasion.
Detects multiple concurrent attempts by a process to identify virtualization or analysis environments (sandbox evasion). The rule monitors for registry key lookups related to VMware/VirtualBox, as well as the execution of commands (via wmic, powershell, or tasklist) aimed at enumerating system information such as video controllers, boot times, operating system details, or process lists. An alert is generated when three or more distinct types of these checks are observed within a 60-second window by the same process, excluding administrative or system-level accounts.
This rule detects malicious VBScript patterns, including Base64 decoding, file operations, and PowerShell execution. It looks for specific VBScript functions and object creations like `CreateObject("MSXML2.DOMDocument.3.0")`, `CreateObject("Scripting.FileSystemObject")`, and `CreateObject("Wscript.Shell")`, as well as patterns related to Base64 decoding. Additionally, it identifies common malicious PowerShell usage through keywords such as `powershell.exe -nop`, `-encodedcommand`, `Invoke-Expression`, `DownloadString`, and various execution policy bypasses or obfuscation techniques. The rule also includes patterns for VBScript window manipulation and script language declarations.
Detects the use of legitimate Windows utilities 'timeout.exe' and 'ping.exe' to introduce delays in command execution. This behavior is often associated with malware or malicious scripts attempting to evade sandboxes or time-based security analysis.
Detects the execution of executables with specific names ("WinHealth.exe", "WindowsSecurity.exe") known to be dropped by the SonicCrypt crypter. The execution is often initiated by the Task Scheduler, resulting in a parent process of 'taskhostw.exe'.
This rule watches a notarised Flutter app wait before calling home and then running shell commands. Delayed contact helps malware evade sandbox checks during install. Behaviour after the delay is the real threat. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
This rule detects HTTP traffic where the URI contains both 'schtasks' and '/delay' (case-insensitive). This combination suggests an attempt to create a scheduled task with a delayed execution, which can be used by adversaries for sandbox evasion or persistence.
This rule detects potential sandbox evasion techniques by identifying HTTP responses containing a 'Sleep(' function call with a duration of 1,000,000 milliseconds (1000 seconds) or more. This long sleep duration is often used by malware to delay execution and bypass time-based sandboxes, which typically have limited execution times for analysis.
Detects a behavioral pattern associated with CastleLoader's anti-analysis technique, where a process initiates a DNS query that fails (NXDOMAIN) and is immediately followed by a successful network connection to a different destination. This can indicate an attempt to check for sandboxing or sinkholing environments.
In this campaign, the threat actor leveraged specially crafted Microsoft RTF files to exploit CVE-2026-21509 and deliver malicious backdoors in a multi-stage infection chain. Due to significant overlaps in tools, techniques, and procedures (TTPs) between this campaign and those of the Russia-linked advanced persistent threat (APT) group APT28, we attribute this new campaign to APT28 with high confidence. Microsoft released an out-of-band update to address CVE-2026-21509 on January 26, 2026. ThreatLabz observed active in-the-wild exploitation on January 29, 2026.
Detects a defense evasion technique used by CHAMELEON#NET where the malware introduces significant delays using multiple 'ping 127.0.0.1 -n <number> > nul' commands chained together. This tactic is designed to bypass automated sandbox analysis by exceeding typical execution timeouts.
Detects a command-line pattern using a ping loopback command to create a delay, a technique used by malware like DarkTortilla/CHAMELEON#NET to evade automated sandbox analysis.
This rule detects the presence of Agenda Ransomware based on specific strings found within the file. These strings include references to 'Qilin' (a known alias for Agenda Ransomware), ransom notes detailing encrypted files and financial information, threats regarding law enforcement, and indicators of the ransomware being written in Rust ('rust', 'cargo'). It also looks for API calls 'Sleep' and 'SleepEx' which can be used for evasion, and an .onion address for communication.
The following analytic detects the use of choice.exe in batch files as a delay tactic, a technique observed in SnakeKeylogger malware. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it indicates potential time-based evasion techniques used by malware to avoid detection. If confirmed malicious, this behavior could allow attackers to execute code stealthily, delete malicious files, and persist on compromised hosts, making it crucial for SOC analysts to investigate promptly.
This analytic identifies the execution of `ping` commands with specific arguments that indicate an attempt to delay malicious code execution. It looks for `ping` commands containing `-n` (number of echo requests), `Nul` (redirecting output to NUL device), and redirection operators (`>`, `&>`). This technique is often used by adversaries to evade detection or sandbox analysis by introducing delays, making it harder to detect and analyze their activities.
The following analytic detects potentially malicious processes that initiate a ping delay using an invalid IP address. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving "ping 0 -n". This behavior is significant as it is commonly used by malware like NJRAT to introduce time delays for evasion tactics, such as delaying self-deletion. If confirmed malicious, this activity could indicate an active infection attempting to evade detection, potentially leading to further compromise and persistence within the environment.
Page 3 of 3