Potential Virtual Machine Fingerprinting via VMDetect

Source: github.com/elastic/protections-artifacts

Identifies the use of VMdetect utility to avoid execution on Malware sandboxes and virtual machines. An adversary may attempt to get detailed information about the operating system and hardware.

MITRE ATT&CK coverage

Tactic	Techniques
Discovery	`T1082` System Information Discovery `T1497.001` Virtualization/Sandbox Evasion: System Checks

Rule body

[rule]
description = """
Identifies the use of VMdetect utility to avoid execution on Malware sandboxes and virtual machines. An adversary may
attempt to get detailed information about the operating system and hardware.
"""
id = "75226c55-55b5-47b6-b27a-757b895c3bce"
license = "Elastic License v2"
name = "Potential Virtual Machine Fingerprinting via VMDetect"
os_list = ["windows"]
reference = ["https://github.com/dretax/VMDetect"]
version = "1.0.22"

query = '''
process where event.action == "start" and process.pe.original_file_name == "vmdetect.exe"
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1082"
name = "System Information Discovery"
reference = "https://attack.mitre.org/techniques/T1082/"

[[threat.technique]]
id = "T1497"
name = "Virtualization/Sandbox Evasion"
reference = "https://attack.mitre.org/techniques/T1497/"
[[threat.technique.subtechnique]]
id = "T1497.001"
name = "System Checks"
reference = "https://attack.mitre.org/techniques/T1497/001/"



[threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[internal]
min_endpoint_version = "7.15.0"

Stages and Predicates

Stage 1: `process`

process where event.action == "start" and process.pe.original_file_name == "vmdetect.exe"

Indicators

These rows show field, operator, and value matches.