Detection rules › Sigma

Powershell Detect Virtualization Environment

Status
test
Severity
medium
Log source
product windows, category ps_script
Author
frack113, Duc.Le-GTSC
Source
github.com/SigmaHQ/sigma

Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox

MITRE ATT&CK coverage

Event coverage

Rule body yaml

title: Powershell Detect Virtualization Environment
id: d93129cd-1ee0-479f-bc03-ca6f129882e3
status: test
description: |
    Adversaries may employ various system checks to detect and avoid virtualization and analysis environments.
    This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1497.001/T1497.001.md
    - https://techgenix.com/malicious-powershell-scripts-evade-detection/
author: frack113, Duc.Le-GTSC
date: 2021-08-03
modified: 2022-03-03
tags:
    - attack.discovery
    - attack.stealth
    - attack.t1497.001
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection_action:
        ScriptBlockText|contains:
            - Get-WmiObject
            - gwmi
    selection_module:
        ScriptBlockText|contains:
            - MSAcpi_ThermalZoneTemperature
            - Win32_ComputerSystem
    condition: all of selection*
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: condition

all of selection*

Stage 1: selection_action

selection_action:
    ScriptBlockText|contains:
        - Get-WmiObject
        - gwmi

Stage 2: selection_module

selection_module:
    ScriptBlockText|contains:
        - MSAcpi_ThermalZoneTemperature
        - Win32_ComputerSystem

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
ScriptBlockTextmatch
  • Get-WmiObject corpus 7 (splunk 5, sigma 2)
  • MSAcpi_ThermalZoneTemperature
  • Win32_ComputerSystem
  • gwmi corpus 2 (sigma 2)