Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in User Guide
Log in Get started
Detection Strategies DET0168 — Virtualization/Sandbox Evasion via System Checks across Windows, Linux, macOS
DET0168

Virtualization/Sandbox Evasion via System Checks across Windows, Linux, macOS

3 analytic(s) · 1 technique(s) detected

Analytics

3
AN0478 Analytic 0478
Windows

Script or binary performs a rapid sequence of system discovery checks (e.g., CPU count, RAM size, registry keys, running processes) indicative of VM detection

WinEventLog:Sysmon EventCode=1 WinEventLog:Sysmon EventCode=7 WinEventLog:Sysmon EventCode=10
[TimeWindow] Sequence of system enumeration events within X seconds
[ProcessAncestry] Parent-child lineage to identify potentially suspicious launch sources (e.g., Office, browser, WMI, PowerShell)
[UserContext] Limit to non-admin or interactive sessions if desired
AN0479 Analytic 0479
Linux

Shell script or binary uses multiple system commands (e.g., dmidecode, lscpu, lspci) in quick succession to detect virtualization environment

auditd:SYSCALL execve of system tools like dmidecode, lspci, lscpu, dmesg, systemd-detect-virt
[TimeWindow] Burst of system info commands within X seconds
[CommandPattern] Regex or substring matching virtualization artifact checks
AN0480 Analytic 0480
macOS

Bash, Swift, or Objective-C programs enumerate system profile, I/O registry, or inspect kernel extensions to identify VM artifacts

macos:unifiedlog exec or spawn of 'system_profiler', 'ioreg', 'kextstat', 'sysctl', or calls to sysctl API
[ExecutionBurst] Threshold of sequential system checks or tools used in a short time
[ToolName] Specific tools used for querying device and system metadata

Detected Techniques

1

Details

MITRE ID
DET0168
STIX ID
x-mitre-detection-strategy--5b998fb4-fb3f-4207-ae00-cdf0e1a22b76
Analytics
3
Techniques Detected
1
By Tactic
Stealth
1
Leaving Threaticon

This link opens an external site that isn't part of the platform.