Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
140 detections
Filters
Last updated
All Time
Detection languages
50
42
24
6
6
Contributors
44
35
20
9
6
Categories
59
44
20
9
7
Platforms
106
14
10
8
5
Products / Services
20
17
12
8
7
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
IDS Classtypes
4
1
1
IDS Protocols
6
This rule detects processes accessing '/proc/self/status' to read the 'TracerPID' field. Malware often uses this technique to detect if it is being debugged or traced by security analysis tools, allowing the process to terminate or change behavior to avoid analysis.
This rule detects processes accessing '/proc/self/status' to read the 'TracerPID' field. Malware often uses this technique to detect if it is being debugged or traced by security analysis tools, allowing the process to terminate or change behavior to avoid analysis.
This rule detects processes accessing '/proc/self/status' to read the 'TracerPID' field. Malware often uses this technique to detect if it is being debugged or traced by security analysis tools, allowing the process to terminate or change behavior to avoid analysis.
This rule detects JavaScript code patterns indicative of the NovaCookies phishing kit, which employs timing-based anti-analysis techniques to detect if a web developer console is open. By checking the execution time of code via a 'clock' function and monitoring for a 'debugger' statement, the kit attempts to withhold the phishing lure from researchers.
Detects JWR phishing framework client engine script via known SHA256 hashes (standalone high-confidence), or the co-occurrence of anti-debug check, staging path structure, and Simplified Chinese operator status strings
Detects the ClickFix TDS (Traffic Direction System) gate, which uses browser-based JavaScript to perform anti-analysis and anti-instrumentation checks. Specifically, it looks for the unauthorized hooking of Array.prototype.includes and the use of canPlayType as a tripwire to detect sandboxes or debuggers, correlated with signs of developer tool usage or prototype property modifications.
Detects HTTP GET requests to UNC6692 Edgecution phishing landing pages hosted on S3 buckets using the 'service-page-*-outlook.s3.us-west-2.amazonaws.com' naming pattern with an 'email=' parameter and '/update.html' URI, used to lure victims into downloading the Edgecution malware suite via fake Outlook/Mailbox Repair Utility pages.
Detects instances where the TOKYOCORE malware (fsociety.exe) attempts to identify or enumerate the presence of security-critical applications, including debuggers, virtual machine guest agents, and antivirus/EDR software. This behavior is indicative of malware attempting to evade analysis or disable security controls.
Detects .NET binaries checking COR_PROFILER env var and IsDebuggerPresent, then calling FailFast to terminate under monitoring, as observed in the Stealth Falcon CURP/DlrtyGames stealer chain
This rule detects processes command lines containing keywords associated with anti-debugging techniques, such as 'PT_DENY_ATTACH' (a common macOS ptrace flag used to prevent debugger attachment) or generic 'ptrace' and 'sysctl' system calls often leveraged by malware for process introspection or debugger evasion.
Detects a specific anti-debugging technique used by LIUSHEN ransomware, where the malware executes a 1,000,000-iteration loop and measures the duration. If the loop takes longer than 0.5 seconds, it infers the presence of a debugger or analysis environment due to the induced latency.
Detects the Snowlight dropper (wusvc.exe) attempting to evade analysis by loading 'verifier.dll' to perform anti-debugging checks. This technique, associated with UNC5221 activity, involves inspecting the process environment and debugger-related messages to detect the presence of debugging tools.
Detects the presence of the 'IsDebuggerPresent' string within command lines. This is a common Windows API call used by malware and potentially malicious scripts to detect if they are running under a debugger, allowing them to alter their behavior to avoid analysis.
Detects the creation of temporary files in the root directory (C:\) following the naming convention 'temp_*.tmp'. This pattern is associated with the evasion or decoy-generation behavior observed in Liushen ransomware, used to check for environmental artifacts or test file system operations.
Detects a process attempting to read its own Process Environment Block (PEB) using NtQueryInformationProcess in combination with ReadProcessMemory, a technique commonly used by malware to detect the presence of a debugger by inspecting the NtGlobalFlag field.
Detects the execution of BQTLock ransomware loader components (start.exe or BQT.exe) that contain embedded PyInstaller environment artifacts. The rule monitors for processes that incorporate specific environment variables associated with PyInstaller-packaged binaries, which are often used by this malware to detect debugger presence and sandbox environments before proceeding with its primary malicious functionality.
Phishing-as-a-Service kit abusing OAuth device code flow against Microsoft 365
Latin American banking trojan using DLL side-loading and overlay attacks
Loader malware delivering follow-on ransomware payloads
This rule detects common Windows processes (msiexec, cmd, dllhost, or rundll32) attempting to detect the presence of a debugger by calling 'IsDebuggerPresent' or 'SetUnhandledExceptionFilter' within their call stack. This behavior is often associated with malware or malicious tools attempting to evade dynamic analysis in sandbox or debugged environments.
Photo-themed ZIP phishing campaign dropping a Node.js implant
Page 3 of 7