Virtualization/Sandbox Evasion T1497

Tactics: Stealth, Discovery

Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from Virtualization/Sandbox Evasion during automated discovery to shape follow-on behaviors.

Events covered

6 catalog events are tagged with this technique by at least one rule.

Authoring guide

These 21 rules share fields, values, and exclusions.

Fields filtered most (20 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
CommandLine15contains 11, in 4, regex_match 2, wildcard 1(?i)whoami|systeminfo|ipconfig|arp|nltest|dclist|domain_t..., *& *, *&*, *&c:*, *--allow-no-sandbox-job*
process_name14in 8, eq 4, regex_match 2brave.exe, chrome.exe, msedge.exe, (?i)(whoami|systeminfo|ipconfig|arp|nltest|tasklist|net1?..., ping.exe
EventType5eq 3, in 2exec, start, ProcessRollup2, exec_event, modification
host.os.type4eq 4
Image3ends_with 2, wildcard 1/sysctl, /system_profiler, ?:\users\*\appdata\*.exe
event.type3eq 3start
process.args3eq 1, in 1, starts_with 1-n, /proc/ide/hd0/model, /proc/scsi/scsi, /sys/class/dmi/id/bios_version, Manufacturer
EventID2eq 21, 4688
OriginalFileName2eq 2ping.exe, vmdetect.exe
ParentCommandLine2in 2, contains 1*& *, *&*, *&c:*, *ping 0 -n *, *ping 0 -n *
dc_process2gt 23
dc_process_name2gt 21
ParentImage1wildcard 1/*.app/*, /applications/*.app/*, /volumes/*.app/*
ScriptBlockText1contains 1get-wmiobject, gwmi, msacpi_thermalzonetemperature
Type1eq 1

Top indicator values (113 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
process_namein
brave.exe
714
process_namein
chrome.exe
718
process_namein
msedge.exe
717
process_namein
opera.exe
713
process_namein
vivaldi.exe
713
event.typeeq
start
31078
process_nameeq
ping.exe
310
CommandLineregex_match
(?i)whoami|systeminfo|ipconfig|arp|nltest|dclist|domain_trusts|tasklist|quser...
22
EventTypeeq
start
2391
dc_processgt
3
24
dc_process_namegt
1
22
process_nameregex_match
(?i)(whoami|systeminfo|ipconfig|arp|nltest|tasklist|net1?|quser|tasklist|nets...
22
CommandLinecontains
--disable-extensions
1
CommandLinecontains
--disable-gpu
12
CommandLinecontains
--disable-logging
1
CommandLinecontains
--disable-popup-blocking
1
CommandLinecontains
--headless
18
CommandLinecontains
--user-data-dir
12
CommandLinecontains
--window-size
1
CommandLinecontains
-n
1
CommandLinecontains
/n
1
CommandLinecontains
/t
12
CommandLinecontains
enabled
12
CommandLinecontains
hw.
1
CommandLinecontains
kern.
1
CommandLinecontains
machdep.
1
CommandLinecontains
spapplicationsdatatype
1
CommandLinecontains
sphardwaredatatype
1
CommandLinecontains
spnetworkdatatype
1
CommandLinecontains
spusbdatatype
1

Exclusions (37 distinct)

These values appear most often in top-level exclusions.

FieldKindValueRules excluding
CommandLineregex_match
(?i)\x5cSplunkUniversalForwarder\x5c(etc|bin)\x5c
2
userregex_match
\$$
2
CommandLineeq
driver\dpinst_x64 /f
1
CurrentDirectoryeq
/home/qualys
1
CurrentDirectorywildcard
?:\Users\*\AppData\Local\Temp\BackupBootstrapper\Logs\
1
CurrentDirectorywildcard
?:\Users\*\AppData\Local\Temp\QBTools\
1
CurrentDirectorywildcard
?:\Windows\TempInst\*
1
OriginalFileNameeq
dpinst.exe
1
ParentCommandLinecontains
screenconnectconfigurator.cmd
1
ParentCommandLineregex_match
(?i)\x5cSplunkUniversalForwarder\x5c(etc|bin)\x5c
1
ParentImageeq
/library/application support/mosyle/mosylemdm.app/contents/macos/mosylemdm
1
ParentImagein
/applications/docker.app/contents/macos/docker
1
ParentImagein
/opt/emby-server/system/embyserver
1
ParentImagein
/usr/libexec/kcare/virt-what
1
ParentImagein
/usr/libexec/valgrind/memcheck-amd64-linux
1

Rules under this technique

These vendors publish rules tagged with this technique.

Domain: Endpoint

Platform (all)

Sigma 3 rules

Elastic 6 rules

Splunk 12 rules