Which SIEM platforms have a T1497 detection rule?

df00tech provides T1497 (Virtualization/Sandbox Evasion) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What severity and confidence is the T1497 detection?

The T1497 detection is rated medium severity with medium confidence.

What are common false positives for T1497?

Common false positives for T1497 include: System administrators running WMI queries for hardware inventory and asset management; IT automation tools (SCCM, Intune, ManageEngine) collecting system hardware information via WMI; Security teams running sandbox detection tests as part of adversary emulation exercises.

T1497

Virtualization/Sandbox Evasion

Q: What data sources are required to detect Virtualization/Sandbox Evasion (T1497)?

Detecting Virtualization/Sandbox Evasion requires the following data sources: Process: Process Creation, Command: Command Execution, Windows Registry: Windows Registry Key Access, Microsoft Defender for Endpoint.

Defense Evasion Discovery Last updated: April 14, 2026

Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Methods include checking for security monitoring tools, system artifacts associated with virtualization, legitimate user activity patterns, and time-based anomalies.

What is T1497 Virtualization/Sandbox Evasion?

Virtualization/Sandbox Evasion (T1497) maps to the Defense Evasion and Discovery tactics — the adversary is trying to avoid being detected in MITRE ATT&CK.

This page provides production-ready detection logic for Virtualization/Sandbox Evasion, covering the data sources and telemetry it touches: Process: Process Creation, Command: Command Execution, Windows Registry: Windows Registry Key Access, Microsoft Defender for Endpoint. The queries below are rated medium severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic: Defense Evasion Discovery
Technique: T1497 Virtualization/Sandbox Evasion
Canonical reference: https://attack.mitre.org/techniques/T1497/

Microsoft Sentinel / Defender

kusto

let VMDetectCommands = dynamic(["MSAcpi_ThermalZoneTemperature", "Win32_Fan", "Win32_ComputerSystem", "VMwareHostOpen.exe", "VBoxService", "vmtoolsd", "vmwaretray", "vboxservice", "qemu-ga", "vmusrvc", "vmsrvc"]);
let VMDetectRegistry = dynamic(["HKLM\\SOFTWARE\\VMware", "HKLM\\SOFTWARE\\Oracle\\VirtualBox", "SYSTEM\\CurrentControlSet\\Services\\VBoxGuest", "SYSTEM\\CurrentControlSet\\Enum\\PCI\\VEN_15AD", "SYSTEM\\CurrentControlSet\\Enum\\PCI\\VEN_80EE"]);
let SandboxDetectTools = dynamic(["wireshark", "procmon", "procexp", "fiddler", "x64dbg", "x32dbg", "ollydbg", "ida64", "idaq", "windbg", "regmon", "filemon", "autoruns"]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has_any (VMDetectCommands)
    or ProcessCommandLine has_any (VMDetectRegistry)
    or (FileName =~ "wmic.exe" and ProcessCommandLine has_any ("MSAcpi_ThermalZoneTemperature", "Win32_Fan", "Win32_ComputerSystem", "Win32_BaseBoard", "Win32_BIOS"))
    or (FileName =~ "reg.exe" and ProcessCommandLine has_any ("VMware", "VirtualBox", "VBoxGuest", "QEMU"))
    or (ProcessCommandLine has "tasklist" and ProcessCommandLine has_any (SandboxDetectTools))
| extend WMICheck = ProcessCommandLine has_any ("MSAcpi_ThermalZoneTemperature", "Win32_Fan", "Win32_ComputerSystem", "Win32_BIOS")
| extend RegistryCheck = ProcessCommandLine has_any ("VMware", "VirtualBox", "VBoxGuest", "QEMU") and FileName =~ "reg.exe"
| extend ProcessScan = ProcessCommandLine has "tasklist" and ProcessCommandLine has_any (SandboxDetectTools)
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         WMICheck, RegistryCheck, ProcessScan
| sort by Timestamp desc

Broad detection for virtualization and sandbox evasion techniques. Monitors for WMI queries targeting thermal zone temperature (VM detection), fan/hardware checks, registry queries for VMware/VirtualBox/QEMU artifacts, and process enumeration looking for analysis tools (Wireshark, ProcMon, debuggers). Covers techniques used by Agent Tesla, Bumblebee, GravityRAT, QakBot, and Raspberry Robin.

medium severity medium confidence

Data Sources

Process: Process Creation Command: Command Execution Windows Registry: Windows Registry Key Access Microsoft Defender for Endpoint

Required Tables

DeviceProcessEvents

False Positives

System administrators running WMI queries for hardware inventory and asset management
IT automation tools (SCCM, Intune, ManageEngine) collecting system hardware information via WMI
Security teams running sandbox detection tests as part of adversary emulation exercises
System monitoring software that queries hardware sensors for health dashboards

Elastic Security (EQL)

eql

process where event.type == "start" and (
  (process.name : "wmic.exe" and process.command_line : ("*MSAcpi_ThermalZoneTemperature*", "*Win32_Fan*", "*Win32_ComputerSystem*", "*Win32_BaseBoard*", "*Win32_BIOS*")) or
  (process.name : "reg.exe" and process.command_line : ("*VMware*", "*VirtualBox*", "*VBoxGuest*", "*QEMU*", "*VEN_15AD*", "*VEN_80EE*")) or
  (process.name : "tasklist.exe" and process.command_line : ("*wireshark*", "*procmon*", "*procexp*", "*fiddler*", "*x64dbg*", "*x32dbg*", "*ollydbg*", "*ida64*", "*idaq*", "*windbg*", "*autoruns*", "*regmon*", "*filemon*")) or
  process.name : ("vmtoolsd.exe", "vmwaretray.exe", "vboxservice.exe", "vmusrvc.exe", "vmsrvc.exe", "qemu-ga.exe", "VMwareHostOpen.exe")
)

Detects T1497 Virtualization/Sandbox Evasion by matching process creation events using Elastic Common Schema (ECS) fields. Covers four evasion vectors: WMI queries for hardware artifacts indicative of a VM (MSAcpi_ThermalZoneTemperature, Win32_Fan, Win32_BIOS via wmic.exe), registry enumeration of known VM vendor keys (VMware, VirtualBox, QEMU vendor IDs via reg.exe), sandbox tool detection via tasklist scanning for debuggers and analysis tools, and direct execution or presence of VM guest agent processes.

high severity medium confidence

Data Sources

Windows Sysmon via Elastic Agent Elastic Endpoint Security

Required Tables

logs-endpoint.events.process-* logs-windows.sysmon_operational-*

False Positives

IT administrators running WMIC hardware inventory queries for asset management or capacity planning — particularly Win32_ComputerSystem and Win32_BIOS queries used by SCCM/Intune baselines to classify physical vs virtual endpoints
VMware vSphere or VirtualBox Guest Additions services legitimately executing vmtoolsd.exe or vboxservice.exe as part of normal VM guest operation — create a suppression for known virtual machine hostnames or gold image build pipelines
Security engineers or QA teams running authorized penetration testing tools (x64dbg, IDA, Wireshark) alongside tasklist enumeration checks on sandboxed analyst workstations

IBM QRadar (AQL)

sql

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
  sourceip AS SourceIP,
  username AS UserName,
  "Image" AS ProcessImage,
  "CommandLine" AS CommandLine,
  "ParentImage" AS ParentProcess,
  CASE WHEN LOWER("CommandLine") IMATCHES '(msacpi_thermalzonetemperature|win32_fan|win32_computersystem|win32_bios|win32_baseboard)' AND LOWER("Image") IMATCHES 'wmic\.exe' THEN 2 ELSE 0 END +
  CASE WHEN LOWER("CommandLine") IMATCHES '(vmware|virtualbox|vboxguest|qemu|ven_15ad|ven_80ee)' AND LOWER("Image") IMATCHES 'reg\.exe' THEN 2 ELSE 0 END +
  CASE WHEN LOWER("CommandLine") IMATCHES 'tasklist' AND LOWER("CommandLine") IMATCHES '(wireshark|procmon|procexp|fiddler|x64dbg|x32dbg|ollydbg|ida64|windbg|autoruns|regmon|filemon)' THEN 2 ELSE 0 END +
  CASE WHEN LOWER("CommandLine") IMATCHES '(vmtoolsd|vmwaretray|vboxservice|vmusrvc|vmsrvc|qemu-ga)' THEN 1 ELSE 0 END AS SuspicionScore
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Snare for Windows Sysmon')
  AND "EventID" = 1
  AND (
    LOWER("CommandLine") IMATCHES '(msacpi_thermalzonetemperature|win32_fan|win32_computersystem|win32_bios|win32_baseboard|vmtoolsd|vmwaretray|vboxservice|vmusrvc|vmsrvc|qemu-ga)'
    OR (LOWER("CommandLine") IMATCHES '(vmware|virtualbox|vboxguest|qemu|ven_15ad|ven_80ee)' AND LOWER("Image") IMATCHES 'reg\.exe')
    OR (LOWER("CommandLine") IMATCHES 'tasklist' AND LOWER("CommandLine") IMATCHES '(wireshark|procmon|procexp|fiddler|x64dbg|x32dbg|ollydbg|ida64|windbg|autoruns|regmon|filemon)')
  )
LAST 24 HOURS

Detects T1497 Virtualization/Sandbox Evasion in IBM QRadar using AQL against Sysmon EventID 1 (Process Create) events. Applies a weighted suspicion score across four VM evasion categories using IMATCHES for case-insensitive regex: WMI hardware artifact queries via wmic.exe (score 2), VM registry key enumeration via reg.exe (score 2), sandbox analysis tool detection via tasklist (score 2), and direct VM guest process detection (score 1). Results include the raw process image and command line for analyst triage.

high severity medium confidence

Data Sources

Windows Sysmon (EventID 1 via Snare or WinCollect) Windows Security Event Log (EventID 4688 with enhanced process auditing)

Required Tables

events

False Positives

System administrators using WMIC for routine hardware diagnostics — Win32_BIOS and MSAcpi_ThermalZoneTemperature queries appear in many legitimate hardware monitoring and IPMI management workflows
Dedicated VM hosts running VMware ESXi guest tools or VirtualBox Guest Additions where vmtoolsd.exe and vboxservice.exe are expected resident processes — exclude by CIDR range or asset group for known hypervisor infrastructure
Authorized red team or penetration testing engagements that include VM evasion checks as part of scoped adversary simulation — correlate SuspicionScore spikes with change windows and approved test plans

Sumo Logic CSE

sql

_sourceCategory=*windows*sysmon* EventID=1
| parse regex "(?i)<CommandLine>(?<CommandLine>[^<]+)</CommandLine>"
| parse regex "(?i)<Image>(?<Image>[^<]+)</Image>"
| parse regex "(?i)<ParentImage>(?<ParentImage>[^<]+)</ParentImage>"
| parse regex "(?i)<User>(?<User>[^<]+)</User>"
| parse regex "(?i)<Computer>(?<Computer>[^<]+)</Computer>"
| where CommandLine matches /(?i)(msacpi_thermalzonetemperature|win32_fan|win32_computersystem|win32_bios|win32_baseboard|vmtoolsd|vmwaretray|vboxservice|vmusrvc|vmsrvc|qemu-ga)/
  OR (CommandLine matches /(?i)(vmware|virtualbox|vboxguest|qemu|ven_15ad|ven_80ee)/ AND Image matches /(?i)reg\.exe/)
  OR (CommandLine matches /(?i)tasklist/ AND CommandLine matches /(?i)(wireshark|procmon|procexp|fiddler|x64dbg|x32dbg|ollydbg|ida64|windbg|autoruns|regmon|filemon)/)
| if(CommandLine matches /(?i)(msacpi_thermalzonetemperature|win32_fan|win32_computersystem|win32_bios|win32_baseboard)/ AND Image matches /(?i)wmic\.exe/, 2, 0) as WMIVMCheck
| if(CommandLine matches /(?i)(vmware|virtualbox|vboxguest|qemu|ven_15ad|ven_80ee)/ AND Image matches /(?i)reg\.exe/, 2, 0) as RegistryVMCheck
| if(CommandLine matches /(?i)tasklist/ AND CommandLine matches /(?i)(wireshark|procmon|procexp|fiddler|x64dbg|x32dbg|ollydbg|ida64|windbg|autoruns|regmon|filemon)/, 2, 0) as ProcessScan
| if(CommandLine matches /(?i)(vmtoolsd|vmwaretray|vboxservice|vmusrvc|vmsrvc|qemu-ga)/, 1, 0) as VMToolCheck
| WMIVMCheck + RegistryVMCheck + ProcessScan + VMToolCheck as SuspicionScore
| fields _time, Computer, User, Image, CommandLine, ParentImage, WMIVMCheck, RegistryVMCheck, ProcessScan, VMToolCheck, SuspicionScore
| sort by -_time

Detects T1497 Virtualization/Sandbox Evasion in Sumo Logic by parsing Sysmon XML process creation events (EventID 1) and applying a multi-indicator suspicion scoring model. Uses `parse regex` to extract structured fields from raw XML and `if()` expressions to score four evasion categories independently: WMI-based VM hardware fingerprinting, VM vendor registry key enumeration, sandbox tool enumeration via tasklist, and VM service process detection. Requires Windows Sysmon source collection with XML event format.

high severity medium confidence

Data Sources

Windows Sysmon via Sumo Logic Installed Collector (Windows Event Log source, XML format)

Required Tables

_sourceCategory matching windows sysmon operational log path

False Positives

Hardware monitoring agents and out-of-band management software (HPE iLO, Dell DRAC management agents) that legitimately query MSAcpi_ThermalZoneTemperature and Win32_Fan via WMI for thermal monitoring
Automated IT asset discovery and software license management platforms (Flexera, Snow Software) that query Win32_ComputerSystem and Win32_BIOS to differentiate physical vs virtual for license compliance reporting
Developer workstations running Docker Desktop, VirtualBox, or WSL2 alongside security research tools (Wireshark, x64dbg) where both VM tool processes and analysis tools are expected to coexist

Google Chronicle / SecOps

yaral

rule t1497_vm_sandbox_evasion {
  meta:
    author = "Detection Engineering"
    description = "Detects T1497 Virtualization/Sandbox Evasion via WMI hardware queries, VM registry enumeration, and sandbox tool scanning"
    mitre_attack_tactic = "Defense Evasion"
    mitre_attack_technique = "T1497"
    severity = "HIGH"
    confidence = "MEDIUM"
    reference = "https://attack.mitre.org/techniques/T1497/"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    (
      (
        $e.target.process.file.basename = /(?i)wmic\.exe/ and
        $e.target.process.command_line = /(?i)(MSAcpi_ThermalZoneTemperature|Win32_Fan|Win32_ComputerSystem|Win32_BaseBoard|Win32_BIOS)/
      ) or
      (
        $e.target.process.file.basename = /(?i)reg\.exe/ and
        $e.target.process.command_line = /(?i)(VMware|VirtualBox|VBoxGuest|QEMU|VEN_15AD|VEN_80EE)/
      ) or
      (
        $e.target.process.command_line = /(?i)tasklist/ and
        $e.target.process.command_line = /(?i)(wireshark|procmon|procexp|fiddler|x64dbg|x32dbg|ollydbg|ida64|idaq|windbg|autoruns|regmon|filemon)/
      ) or
      $e.target.process.file.basename = /(?i)(vmtoolsd|vmwaretray|vboxservice|vmusrvc|vmsrvc|qemu-ga|VMwareHostOpen)\.exe/
    )

  condition:
    $e
}

Chronicle YARA-L 2.0 rule detecting T1497 Virtualization/Sandbox Evasion. Matches PROCESS_LAUNCH UDM events using regex on target process basename (case-insensitive filename match without full path dependency) and command line. Covers all four evasion vectors detected in the reference KQL/SPL: WMI-based hardware fingerprinting via wmic.exe, VM vendor registry key querying via reg.exe, sandbox analysis tool enumeration via tasklist, and direct VM guest service process identification. The `condition: $e` fires on any single matching event.

high severity medium confidence

Data Sources

Chronicle UDM via Google SecOps Windows endpoint telemetry ingested via Chronicle Forwarder or third-party EDR UDM normalization

Required Tables

UDM PROCESS_LAUNCH events with target.process.file.basename and target.process.command_line populated

False Positives

VMware ESXi or Workstation host management consoles spawning VMwareHostOpen.exe or vmtoolsd.exe as part of authorized guest VM lifecycle operations — add exclusion rule matching principal.hostname against known hypervisor host inventory
Enterprise software packaging and deployment systems (Microsoft SCCM task sequences, Intune Win32 app wrappers) that call wmic.exe to query Win32_ComputerSystem model and Win32_BIOS serial number for hardware-targeted deployment logic
Security awareness training platforms or malware detonation sandboxes that run commodity malware samples as part of controlled exercises — these will trigger all four detection categories simultaneously and at high frequency from known sandbox hostnames

CrowdStrike LogScale (CQL)

cql

#event_simpleName = "ProcessRollup2"
| CommandLine = *
| lower(CommandLine) = cmdLine
| lower(ImageFileName) = imgName
| wmiVMCheck := if(cmdLine = /(msacpi_thermalzonetemperature|win32_fan|win32_computersystem|win32_bios|win32_baseboard)/ and imgName = /wmic\.exe/, 2, 0)
| regVMCheck := if(cmdLine = /(vmware|virtualbox|vboxguest|qemu|ven_15ad|ven_80ee)/ and imgName = /reg\.exe/, 2, 0)
| procScan := if(cmdLine = /tasklist/ and cmdLine = /(wireshark|procmon|procexp|fiddler|x64dbg|x32dbg|ollydbg|ida64|idaq|windbg|autoruns|regmon|filemon)/, 2, 0)
| vmToolCheck := if(cmdLine = /(vmtoolsd|vmwaretray|vboxservice|vmusrvc|vmsrvc|qemu-ga)/, 1, 0)
| suspicionScore := wmiVMCheck + regVMCheck + procScan + vmToolCheck
| suspicionScore > 0
| select([timestamp, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, ParentCommandLine, wmiVMCheck, regVMCheck, procScan, vmToolCheck, suspicionScore])
| sort(suspicionScore, order=desc, limit=1000)

Detects T1497 Virtualization/Sandbox Evasion using CrowdStrike Falcon LogScale (FLQL) against ProcessRollup2 events from the Falcon sensor. Applies a multi-indicator suspicion score model: WMI VM hardware queries via wmic.exe (2 pts), registry VM vendor key enumeration via reg.exe (2 pts), sandbox tool enumeration via tasklist (2 pts), and VM guest service process name detection (1 pt). Lowercase normalization via `lower()` ensures case-insensitive matching without performance overhead. Leverages Falcon's high-fidelity command line capture which is more complete than Windows native event logging for obfuscated or long command lines.

high severity high confidence

Data Sources

CrowdStrike Falcon EDR — ProcessRollup2 events via Falcon sensor telemetry

Required Tables

ProcessRollup2 events streamed via Falcon Data Replicator or Humio/LogScale Falcon connector

False Positives

CrowdStrike Falcon sensor itself or competing EDR agents may internally invoke wmic.exe to query Win32_ComputerSystem for device fingerprinting — filter by ParentBaseFileName matching known security tool parent process names
Software installation wrappers (NSIS, InstallShield, WiX installers) that query Win32_ComputerSystem model or Win32_BIOS serial number to gate license validation or detect virtual lab environments for trial enforcement
Cloud VM provisioning and image baking pipelines (Packer, Terraform provisioners) that query Hyper-V and VMware registry keys to configure OS-level tuning for virtualized workloads — suppress by ComputerName prefix matching known build agent naming conventions

Sigma rule & cross-platform mapping

The detection logic for Virtualization/Sandbox Evasion (T1497) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource:

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1497 Sigma rules on detection.fyi

Platform-specific guides for T1497

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)

Last updated: 2026-04-14 Research depth: deep

References (5)

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1WMI thermal zone temperature check for VM detection
Expected signal: Sysmon Event ID 1: Process Create with Image=wmic.exe, CommandLine containing 'MSAcpi_ThermalZoneTemperature'. WMI trace log entry in Microsoft-Windows-WMI-Activity/Operational.
Test 2Registry check for VMware artifacts
Expected signal: Sysmon Event ID 1: Process Create with Image=reg.exe, CommandLine containing 'VMware' and 'VBoxGuest'. Sysmon Event ID 13: RegistryEvent for key access.
Test 3Process enumeration for analysis tools
Expected signal: Sysmon Event ID 1: Multiple Process Create events for tasklist.exe with filter arguments. Each tasklist invocation generates a separate process event.

Response Playbook

Triage

Determine the context — is this an endpoint that legitimately runs in a VM, or is it a physical workstation?
Examine the parent process chain — was the VM detection initiated by a known application, a recently downloaded binary, or a script?
Check if the process made additional checks beyond a single query — multiple VM/sandbox detection techniques in sequence is a strong indicator of evasion behavior
Look for conditional behavior — did the process exit, sleep, or change behavior after the VM check?
Correlate with recent file downloads or email attachments — VM evasion is often the first step in a malware execution chain
Check if the process is signed — unsigned binaries performing VM detection are much more suspicious

Containment

If confirmed malware with sandbox evasion: quarantine the binary via EDR and block its hash environment-wide
Submit the sample to a sandbox that can handle evasion techniques (counter-evasion enabled) for full behavioral analysis
If the malware evaded initial sandbox analysis: resubmit with anti-evasion countermeasures (hardware-backed analysis)
Investigate the delivery mechanism and block the initial access vector (phishing email, malicious URL, etc.)
Check other endpoints that may have received the same payload via the same delivery mechanism

Evidence Collection

Sysmon Event ID 1 (Process Create) for the VM detection process and full parent chain
Sysmon Event ID 13 (Registry Value Set/Delete) for registry queries targeting VM artifacts
Sysmon Event ID 17/18 (Pipe Create/Connect) for named pipes associated with VM tools
WMI trace logs (Microsoft-Windows-WMI-Activity/Operational) for WMI-based VM queries
File system: the binary itself for reverse engineering and sandbox resubmission
Network logs: any C2 communication that occurred after the VM check passed

Escalation Criteria

! Multiple VM/sandbox evasion techniques executed in sequence by the same process (systematic evasion)
! VM evasion check followed by payload deployment or C2 communication
! Evasion behavior from a binary that arrived via email attachment or web download
! Process terminates itself after detecting VM artifacts (confirms evasion intent)
! Same VM-evasive sample detected on multiple endpoints (campaign-level threat)

Investigation Guide

Forensic Artifacts

> Registry: HKLM\SOFTWARE\VMware, Inc. (VMware guest tools)
> Registry: HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions (VirtualBox)
> Registry: HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest (VirtualBox driver)
> Registry: HKLM\SYSTEM\CurrentControlSet\Enum\PCI\VEN_15AD (VMware PCI devices)
> File System: C:\Windows\System32\drivers\VBoxMouse.sys, VBoxGuest.sys (VirtualBox drivers)
> File System: C:\Program Files\VMware\VMware Tools\ (VMware Tools installation)
> WMI: Win32_ComputerSystem.Model contains 'Virtual' or 'VMware'
> Process List: vmtoolsd.exe, VBoxService.exe, qemu-ga.exe running

Tuning Guidance

VM/sandbox evasion detections have moderate false positive rates due to legitimate hardware inventory and monitoring tools. Key tuning strategies: (1) Exclude known asset management tools (SCCM client, ManageEngine, Lansweeper) that run WMI hardware queries on schedule. (2) Focus on the parent process — WMI hardware queries from wscript.exe, mshta.exe, powershell.exe, or unknown binaries are suspicious; those from sccm.exe are expected. (3) Weight multiple evasion techniques from the same process higher than individual checks. (4) For registry-based detections, exclude vmtoolsd.exe and VBoxService.exe which legitimately access their own keys. (5) On analysis workstations, these detections will fire frequently — consider separate rulesets for analyst VMs.

Hunting Queries

Hunt for WMI thermal zone and fan sensor queries — classic VM detection techniques. Physical machines have temperature sensors; most VMs do not. OopsIE (OilRig) and GravityRAT specifically use this technique.

Hunting — KQL

kql

DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "wmic.exe" and ProcessCommandLine has_any ("MSAcpi_ThermalZoneTemperature", "Win32_Fan")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc

Hunting — SPL

spl

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 Image="*\\wmic.exe" (CommandLine="*MSAcpi_ThermalZoneTemperature*" OR CommandLine="*Win32_Fan*")
| table _time, host, User, CommandLine, ParentImage, ParentCommandLine
| sort - _time

Hunt for non-VM-tool processes querying VM-related registry keys. Legitimate VM tools (vmtoolsd, VBoxService) access their own keys — other processes doing so indicates sandbox/VM detection behavior.

Hunting — KQL

kql

DeviceRegistryEvents
| where Timestamp > ago(7d)
| where RegistryKey has_any ("VMware", "VirtualBox", "VBoxGuest", "QEMU", "VEN_15AD", "VEN_80EE")
| where InitiatingProcessFileName !in~ ("vmtoolsd.exe", "VBoxService.exe", "MsMpEng.exe", "explorer.exe")
| project Timestamp, DeviceName, AccountName, RegistryKey, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc

Hunting — SPL

spl

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=13 (TargetObject="*VMware*" OR TargetObject="*VirtualBox*" OR TargetObject="*VBoxGuest*" OR TargetObject="*QEMU*" OR TargetObject="*VEN_15AD*" OR TargetObject="*VEN_80EE*") NOT (Image="*vmtoolsd.exe" OR Image="*VBoxService.exe" OR Image="*MsMpEng.exe")
| table _time, host, User, Image, TargetObject
| sort - _time

Hunt for known VM detection and anti-analysis testing tools (pafish, al-khaser, vmdetect.exe). While these are used by researchers, their presence on production endpoints is suspicious. Metamorfo malware has embedded vmdetect.exe.

Hunting — KQL

kql

DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessCommandLine has_any ("vmdetect", "pafish", "al-khaser", "SandboxEvasion", "AntiVM")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc

Hunting — SPL

spl

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (CommandLine="*vmdetect*" OR CommandLine="*pafish*" OR CommandLine="*al-khaser*" OR CommandLine="*SandboxEvasion*" OR CommandLine="*AntiVM*")
| table _time, host, User, Image, CommandLine, ParentImage
| sort - _time

Atomic Red Team Tests

Test 1 WMI thermal zone temperature check for VM detection

windows

Queries the WMI MSAcpi_ThermalZoneTemperature class to check for hardware temperature sensors. Virtual machines typically lack thermal zones, so an empty result indicates a VM. This exact WMI query is used by OopsIE (OilRig) and GravityRAT for sandbox evasion.

Command

powershell

wmic /namespace:\\root\WMI path MSAcpi_ThermalZoneTemperature get CurrentTemperature

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=wmic.exe, CommandLine containing 'MSAcpi_ThermalZoneTemperature'. WMI trace log entry in Microsoft-Windows-WMI-Activity/Operational.

Expected Detection

Alert fires on 'MSAcpi_ThermalZoneTemperature' WMI query. KQL: WMICheck=true. SPL: WMIVMCheck=1, SuspicionScore >= 2.

Test 2 Registry check for VMware artifacts

windows

Queries the Windows registry for VMware-related keys that indicate the presence of VMware virtual machine guest tools. Malware families like Bumblebee, SodaMaster, and DarkTortilla check for these keys before proceeding with their payload.

Command

powershell

reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools" 2>nul & reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest" 2>nul

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=reg.exe, CommandLine containing 'VMware' and 'VBoxGuest'. Sysmon Event ID 13: RegistryEvent for key access.

Expected Detection

Alert fires on reg.exe querying VMware/VirtualBox registry keys. KQL: RegistryCheck=true. SPL: RegistryVMCheck=1, SuspicionScore >= 2.

Test 3 Process enumeration for analysis tools

windows

Uses tasklist to search for common security analysis tools (Wireshark, Process Monitor, debuggers) that indicate an analysis environment. QakBot, Lucifer, and WhisperGate check for these tools before executing their payloads.

Command

powershell

tasklist /FI "IMAGENAME eq wireshark.exe" & tasklist /FI "IMAGENAME eq procmon.exe" & tasklist /FI "IMAGENAME eq x64dbg.exe" & tasklist /FI "IMAGENAME eq ollydbg.exe"

Expected Telemetry

Sysmon Event ID 1: Multiple Process Create events for tasklist.exe with filter arguments. Each tasklist invocation generates a separate process event.

Expected Detection

Alert fires on tasklist + analysis tool name pattern. KQL: ProcessScan=true. SPL: ProcessScan=1, SuspicionScore >= 2.

Related Detections

Tactic Hubs

TA0005Defense Evasion TA0007Discovery

What is T1497 Virtualization/Sandbox Evasion?

MITRE ATT&CK

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Sigma rule & cross-platform mapping

Platform-specific guides for T1497

Testing Methodology

Response Playbook

Triage

Containment

Evidence Collection

Escalation Criteria

Investigation Guide

Forensic Artifacts

Tuning Guidance

Hunting Queries

Atomic Red Team Tests

Command

Expected Telemetry

Expected Detection

Command

Expected Telemetry

Expected Detection

Command

Expected Telemetry

Expected Detection

Related Detections

Tactic Hubs

Sub-techniques (3)

Related Techniques

Same Tactic: Defense Evasion

Popular Detections

Get new detections in your inbox