Powershell Detect Virtualization Environment

Status: test
Severity: medium
Log source: category ps_script, product windows
Author: frack113, Duc.Le-GTSC
Source: github.com/SigmaHQ/sigma

Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1497.001` Virtualization/Sandbox Evasion: System Checks
Discovery	`T1497.001` Virtualization/Sandbox Evasion: System Checks

Telemetry coverage

Provider	Record / event type
PowerShell	Event ID 4104: Creating Scriptblock text (MessageNumber of MessageTotal).

Rule body

title: Powershell Detect Virtualization Environment
id: d93129cd-1ee0-479f-bc03-ca6f129882e3
status: test
description: |
    Adversaries may employ various system checks to detect and avoid virtualization and analysis environments.
    This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1497.001/T1497.001.md
    - https://techgenix.com/malicious-powershell-scripts-evade-detection/
author: frack113, Duc.Le-GTSC
date: 2021-08-03
modified: 2022-03-03
tags:
    - attack.discovery
    - attack.stealth
    - attack.t1497.001
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection_action:
        ScriptBlockText|contains:
            - Get-WmiObject
            - gwmi
    selection_module:
        ScriptBlockText|contains:
            - MSAcpi_ThermalZoneTemperature
            - Win32_ComputerSystem
    condition: all of selection*
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: `condition`

all of selection*

Stage 1: `selection_action`

selection_action:
    ScriptBlockText|contains:
        - Get-WmiObject
        - gwmi

Stage 2: `selection_module`

selection_module:
    ScriptBlockText|contains:
        - MSAcpi_ThermalZoneTemperature
        - Win32_ComputerSystem

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ScriptBlockText`	match	`Get-WmiObject` corpus 7 (splunk 5, sigma 2) `MSAcpi_ThermalZoneTemperature` `Win32_ComputerSystem` `gwmi` corpus 2 (sigma 2)	`field:"ScriptBlockText" kind:match`