Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
33 detections
Filters
Last updated
All Time
Detection languages
17
10
3
1
1
Contributors
12
4
3
3
3
Categories
19
18
11
5
3
Platforms
28
2
2
1
Products / Services
10
5
5
2
2
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
Detects the use of QEMU with port forwarding (`hostfwd`), a technique observed being used by attackers to create a persistent, virtualized environment for C2 and lateral movement, often via a scheduled task. The rule looks for the creation of scheduled tasks that launch QEMU with port forwarding or the direct execution of QEMU with port forwarding by common parent processes associated with scheduled tasks or remote administration.
Detects the execution of QEMU with parameters to launch a virtual machine with a disk image and networking capabilities. Adversaries have been observed using this "Bring Your Own VM" (BYO-VM) technique to create an isolated operational environment on a compromised host, evading host-based defenses and establishing persistence. This activity was notably preceded by social engineering via Quick Assist, leading to execution by "wscript.exe".
This query looks for DISM enable & disable events on the same device within a 15-minute window.
Detects the enablement of the Hyper-V feature, particularly when the management clients are disabled simultaneously. This combination of actions is a technique used by the Curly COMrades threat actor to create a hidden virtualized environment for evasion purposes.
Detects scenarios where a default Windows host name pattern (WIN-...) is detected during a login attempt. Having a host with a default name may be an indicator of a fresh machine deployed by an attacker to evade detection and perform malicious activities.
Detects scenarios where an attacker enables the WSL to cary out malicious activities in a virtual instance to avoid detection.
Detects scenarios where an attacker enables the WSL to cary out malicious activities in a virtual instance to avoid detection.
This rule detects the installation of VirtualBox drivers or the initiation of VirtualBox virtual machines. Adversaries, particularly ransomware groups like Ragnar Locker and Maze, have been observed using virtual instances to execute malicious operations, thereby evading detection by security tools on the host system. The rule specifically looks for command-line arguments related to VirtualBox driver components (VBoxRT.dll, VBoxC.dll, VBoxDrv.sys) or commands used to start/control virtual machines ('startvm', 'controlvm').
Adversaries may carry out malicious operations using a virtual instance to avoid detection
Adversaries can carry out malicious operations using a virtual instance to avoid detection. This rule is built to detect the registration of the Virtualbox driver or start of a Virtualbox VM.
Adversaries can carry out malicious operations using a virtual instance to avoid detection. This rule is built to detect the registration of the Virtualbox driver or start of a Virtualbox VM.
This rule detects the execution of specific PowerShell cmdlets related to Hyper-V virtual machine management. Adversaries may use these cmdlets to create, configure, or start virtual machines to evade detection by isolating malicious activities within a virtualized environment. The rule specifically looks for 'New-VM', 'Set-VMFirmware', and 'Start-VM' within PowerShell script block text.
Page 2 of 2