[rule]
description = """
Identifies the use of VMdetect utility to avoid execution on Malware sandboxes and virtual machines. An adversary may
attempt to get detailed information about the operating system and hardware.
"""
id = "75226c55-55b5-47b6-b27a-757b895c3bce"
license = "Elastic License v2"
name = "Potential Virtual Machine Fingerprinting via VMDetect"
os_list = ["windows"]
reference = ["https://github.com/dretax/VMDetect"]
version = "1.0.22"
query = '''
process where event.action == "start" and process.pe.original_file_name == "vmdetect.exe"
'''
min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1082"
name = "System Information Discovery"
reference = "https://attack.mitre.org/techniques/T1082/"
[[threat.technique]]
id = "T1497"
name = "Virtualization/Sandbox Evasion"
reference = "https://attack.mitre.org/techniques/T1497/"
[[threat.technique.subtechnique]]
id = "T1497.001"
name = "System Checks"
reference = "https://attack.mitre.org/techniques/T1497/001/"
[threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"
[internal]
min_endpoint_version = "7.15.0"