AN0478
Analytic 0478
Windows
Script or binary performs a rapid sequence of system discovery checks (e.g., CPU count, RAM size, registry keys, running processes) indicative of VM detection
WinEventLog:Sysmon
EventCode=1
WinEventLog:Sysmon
EventCode=7
WinEventLog:Sysmon
EventCode=10
[TimeWindow]
Sequence of system enumeration events within X seconds
[ProcessAncestry]
Parent-child lineage to identify potentially suspicious launch sources (e.g., Office, browser, WMI, PowerShell)
[UserContext]
Limit to non-admin or interactive sessions if desired
AN0479
Analytic 0479
Linux
Shell script or binary uses multiple system commands (e.g., dmidecode, lscpu, lspci) in quick succession to detect virtualization environment
auditd:SYSCALL
execve of system tools like dmidecode, lspci, lscpu, dmesg, systemd-detect-virt
[TimeWindow]
Burst of system info commands within X seconds
[CommandPattern]
Regex or substring matching virtualization artifact checks
AN0480
Analytic 0480
macOS
Bash, Swift, or Objective-C programs enumerate system profile, I/O registry, or inspect kernel extensions to identify VM artifacts
macos:unifiedlog
exec or spawn of 'system_profiler', 'ioreg', 'kextstat', 'sysctl', or calls to sysctl API
[ExecutionBurst]
Threshold of sequential system checks or tools used in a short time
[ToolName]
Specific tools used for querying device and system metadata