Cross-source coverage

T1497 / ATT&CK

Virtualization/Sandbox Evasion

33 rules · 32 families across 7 sources.

1 deprecated hidden · include

From MITRE ATT&CK 19.2

Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from Virtualization/Sandbox Evasion during automated discovery to shape follow-on behaviors.

Adversaries may use several methods to accomplish Virtualization/Sandbox Evasion such as checking for security monitoring tools (e.g., Sysinternals, Wireshark, etc.) or other system artifacts associated with analysis or virtualization. Adversaries may also check for legitimate user activity to help determine if it is in an analysis environment. Additional methods include use of sleep timers or loops within malware code to avoid operating within a temporary sandbox.

Tactics
Stealth · Discovery
Platforms
Linux · macOS · Windows
Telemetry
WinEventLog:Sysmonauditd:SYSCALLmacos:unifiedlog

How MITRE says to detect it DET0046

Detection Strategy for T1497 Virtualization/Sandbox Evasion

Windows Analytic 0127

Execution of discovery commands or API calls for virtualization artifacts (e.g., registry keys, device drivers, services), sleep/skipped execution behavior, or sandbox evasion DLLs before payload deployment.

  • WinEventLog:Sysmon EventCode=1
  • WinEventLog:Sysmon EventCode=7

Linux Analytic 0128

Execution of commands to enumerate virtualization-related files or processes (e.g., '/sys/class/dmi/id/product_name', dmesg, lscpu, lspci), or querying hypervisor interfaces prior to malware execution.

  • auditd:SYSCALL execve or syscall invoking vm artifact check commands (e.g., dmidecode, lspci, dmesg)
  • auditd:SYSCALL sleep function usage or loops (nanosleep, usleep) in scripts

macOS Analytic 0129

Execution of scripts or binaries that check for virtualization indicators (e.g., system_profiler, ioreg -l, kextstat), combined with delay functions or anomalous launchd activity.

  • macos:unifiedlog execution of system_profiler, ioreg, kextstat with argument patterns related to VM/sandbox checks
  • macos:unifiedlog dynamic loading of sleep-related functions or sandbox detection libraries

View on attack.mitre.org ↗

Sub-techniques with coverage

Counted in the 33 above — a rule tagged a sub-technique covers this technique too.

splunk/security_content

10 rules
Detection Severity Format
Headless Browser Usage Undefined SPL
Ping Sleep Batch Command Undefined SPL
Windows Chromium Browser Launched with Small Window Size Undefined SPL
Windows Chromium Browser No Security Sandbox Process Undefined SPL
Windows Chromium Browser with Custom User Data Directory Undefined SPL
Windows Chromium process Launched with Disable Popup Blocking Undefined SPL
Windows Chromium Process Launched with Logging Disabled Undefined SPL
Windows Chromium Process with Disabled Extensions Undefined SPL
Windows Time Based Evasion Undefined SPL
Windows Time Based Evasion via Choice Exec Undefined SPL

Wazuh Core Ruleset

6 rules
Detection Severity Format
Multiple VMWare ESX authentication failures. High Wazuh XML
Multiple VMWare ESX error messages. High Wazuh XML
Multiple VMWare ESX user authentication failures. High Wazuh XML
Multiple VMWare ESX warning messages. High Wazuh XML
Powershell queried Win32_BIOS. Possible sandbox detection activity Low Wazuh XML
Powershell queried Win32_ComputerSystem. Possible system discovery activity Low Wazuh XML

socfortress/Wazuh-Rules

6 rules · 5 families
Detection Severity Format
Ping command used with -c option — potential sandbox evasion (T1497.003) command= ping -c 3 8.8.8.8 High Wazuh XML
Sysmon - Event 1: Process creation · Suspicious PowerShell Virtualization Check (T1497.001) High Wazuh XML
Sysmon - Event 1: Process creation · Virtualization Check via WMI Model/Manufacturer (T1497.001) High Wazuh XML
Sysmon - Event 1: Process creation · Virtualization Check via WMI Temperature (T1497.001) High Wazuh XML
Virtualization detection command executed: systemd-detect-virt 2 variants High Wazuh XML
Virtualization detection command executed: systemd-detect-virt 2 variants High Wazuh XML

elastic/detection-rules

5 rules
Detection Severity Format
Potential Microsoft Office Sandbox Evasion High Elastic TOML
Virtual Machine Fingerprinting High Elastic TOML
Suspicious SIP Check by macOS Application Medium Elastic TOML
Virtual Machine Fingerprinting via Grep Medium Elastic TOML
Delayed Execution via Ping Low Elastic TOML

SigmaHQ/sigma

3 rules
Detection Severity Format
Powershell Detect Virtualization Environment Medium Sigma
System Information Discovery Using System_Profiler Medium Sigma
System Information Discovery Via Sysctl - MacOS Medium Sigma

chainguard-dev/osquery-defense-kit

2 rules
Detection Severity Format
Unexpected calls to macOS system utilities (event-based) Undefined osquery SQL
Unexpected calls to system utilities (event-based) Undefined osquery SQL

elastic/protections-artifacts

1 rule
Detection Severity Format
Potential Virtual Machine Fingerprinting via VMDetect Undefined Elastic TOML

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.