MITRE ATT&CK technique
Virtualization/Sandbox Evasion detection rulesT1497
Virtualization/Sandbox Evasion (T1497) is a MITRE ATT&CK technique in the Stealth tactic. This page lists the 3 community-maintained Sigma detection rules in the library mapped to T1497 and its sub-techniques. Each rule includes its detection logic, log source, false positives and original YAML. These rules mainly target macos, windows.
Powershell Detect Virtualization Environment
mediumAdversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox
windows · ps_script
System Information Discovery Using System_Profiler
mediumDetects the execution of "system_profiler" with specific "Data Types" that have been seen being used by threat actors and malware. It provides system hardware and software configuration information. This process is primarily used for system information discovery. However, "system_profiler" can also be used to determine if virtualization software is being run for defense evasion purposes.
macos · process_creation
System Information Discovery Via Sysctl - MacOS
mediumDetects the execution of "sysctl" with specific arguments that have been used by threat actors and malware. It provides system hardware information. This process is primarily used to detect and avoid virtualization and analysis environments.
macos · process_creation