Detect Virtualization/Sandbox Evasion in Splunk
Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Methods include checking for security monitoring tools, system artifacts associated with virtualization, legitimate user activity patterns, and time-based anomalies.
MITRE ATT&CK
- Tactic
- Defense Evasion Discovery
- Technique
- T1497 Virtualization/Sandbox Evasion
- Canonical reference
- https://attack.mitre.org/techniques/T1497/
SPL Detection Query
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval CommandLine=lower(CommandLine)
| eval WMIVMCheck=if(match(CommandLine, "(msacpi_thermalzonetemperature|win32_fan|win32_computersystem.*model|win32_bios.*serialnumber|win32_baseboard)") AND match(Image, "(?i)wmic"), 1, 0)
| eval RegistryVMCheck=if(match(CommandLine, "(vmware|virtualbox|vboxguest|qemu|xen|hyper-v)") AND match(Image, "(?i)reg\.exe"), 1, 0)
| eval ProcessScan=if(match(CommandLine, "tasklist") AND match(CommandLine, "(wireshark|procmon|procexp|fiddler|x64dbg|x32dbg|ollydbg|ida|windbg|autoruns|regmon|filemon)"), 1, 0)
| eval VMToolCheck=if(match(CommandLine, "(vmtoolsd|vmwaretray|vboxservice|vmusrvc|vmsrvc|qemu-ga)"), 1, 0)
| eval SuspicionScore=WMIVMCheck*2 + RegistryVMCheck*2 + ProcessScan*2 + VMToolCheck
| where SuspicionScore > 0
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine, WMIVMCheck, RegistryVMCheck, ProcessScan, VMToolCheck, SuspicionScore
| sort - _timeDetects virtualization and sandbox evasion behavior via Sysmon process creation events. Identifies WMI-based VM detection (temperature, fan, hardware queries), registry checks for virtualization software, process enumeration for analysis tools, and checks for VM guest service processes. Each detection category is scored for prioritization.
Data Sources
Required Sourcetypes
False Positives & Tuning
- System administrators running WMI hardware inventory queries
- IT automation tools collecting hardware information
- Security teams conducting adversary emulation exercises
- Hardware monitoring software querying sensors
Other platforms for T1497
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1 WMI thermal zone temperature check for VM detection
Expected signal: Sysmon Event ID 1: Process Create with Image=wmic.exe, CommandLine containing 'MSAcpi_ThermalZoneTemperature'. WMI trace log entry in Microsoft-Windows-WMI-Activity/Operational.
- Test 2 Registry check for VMware artifacts
Expected signal: Sysmon Event ID 1: Process Create with Image=reg.exe, CommandLine containing 'VMware' and 'VBoxGuest'. Sysmon Event ID 13: RegistryEvent for key access.
- Test 3 Process enumeration for analysis tools
Expected signal: Sysmon Event ID 1: Multiple Process Create events for tasklist.exe with filter arguments. Each tasklist invocation generates a separate process event.
References (5)
- https://attack.mitre.org/techniques/T1497/
- https://drive.google.com/file/d/1t0jn3xr4ff2fR30oQAUn_RsWSnMpOAQc/edit
- https://unit42.paloaltonetworks.com/ups-observations-on-cve-2015-3113-prior-zero-days-and-the-pirpi-payload/
- https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/stopping-malware-fake-virtual-machine/
- https://github.com/a0rtega/pafish
Response Playbook
Triage
- Determine the context — is this an endpoint that legitimately runs in a VM, or is it a physical workstation?
- Examine the parent process chain — was the VM detection initiated by a known application, a recently downloaded binary, or a script?
- Check if the process made additional checks beyond a single query — multiple VM/sandbox detection techniques in sequence is a strong indicator of evasion behavior
- Look for conditional behavior — did the process exit, sleep, or change behavior after the VM check?
- Correlate with recent file downloads or email attachments — VM evasion is often the first step in a malware execution chain
- Check if the process is signed — unsigned binaries performing VM detection are much more suspicious
Containment
- If confirmed malware with sandbox evasion: quarantine the binary via EDR and block its hash environment-wide
- Submit the sample to a sandbox that can handle evasion techniques (counter-evasion enabled) for full behavioral analysis
- If the malware evaded initial sandbox analysis: resubmit with anti-evasion countermeasures (hardware-backed analysis)
- Investigate the delivery mechanism and block the initial access vector (phishing email, malicious URL, etc.)
- Check other endpoints that may have received the same payload via the same delivery mechanism
Evidence Collection
- Sysmon Event ID 1 (Process Create) for the VM detection process and full parent chain
- Sysmon Event ID 13 (Registry Value Set/Delete) for registry queries targeting VM artifacts
- Sysmon Event ID 17/18 (Pipe Create/Connect) for named pipes associated with VM tools
- WMI trace logs (Microsoft-Windows-WMI-Activity/Operational) for WMI-based VM queries
- File system: the binary itself for reverse engineering and sandbox resubmission
- Network logs: any C2 communication that occurred after the VM check passed
Escalation Criteria
- !Multiple VM/sandbox evasion techniques executed in sequence by the same process (systematic evasion)
- !VM evasion check followed by payload deployment or C2 communication
- !Evasion behavior from a binary that arrived via email attachment or web download
- !Process terminates itself after detecting VM artifacts (confirms evasion intent)
- !Same VM-evasive sample detected on multiple endpoints (campaign-level threat)
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Registry: HKLM\SOFTWARE\VMware, Inc. (VMware guest tools) - >
Registry: HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions (VirtualBox) - >
Registry: HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest (VirtualBox driver) - >
Registry: HKLM\SYSTEM\CurrentControlSet\Enum\PCI\VEN_15AD (VMware PCI devices) - >
File System: C:\Windows\System32\drivers\VBoxMouse.sys, VBoxGuest.sys (VirtualBox drivers) - >
File System: C:\Program Files\VMware\VMware Tools\ (VMware Tools installation) - >
WMI: Win32_ComputerSystem.Model contains 'Virtual' or 'VMware' - >
Process List: vmtoolsd.exe, VBoxService.exe, qemu-ga.exe running
Tuning Guidance
VM/sandbox evasion detections have moderate false positive rates due to legitimate hardware inventory and monitoring tools. Key tuning strategies: (1) Exclude known asset management tools (SCCM client, ManageEngine, Lansweeper) that run WMI hardware queries on schedule. (2) Focus on the parent process — WMI hardware queries from wscript.exe, mshta.exe, powershell.exe, or unknown binaries are suspicious; those from sccm.exe are expected. (3) Weight multiple evasion techniques from the same process higher than individual checks. (4) For registry-based detections, exclude vmtoolsd.exe and VBoxService.exe which legitimately access their own keys. (5) On analysis workstations, these detections will fire frequently — consider separate rulesets for analyst VMs.
Hunting Queries
Hunt for WMI thermal zone and fan sensor queries — classic VM detection techniques. Physical machines have temperature sensors; most VMs do not. OopsIE (OilRig) and GravityRAT specifically use this technique.
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "wmic.exe" and ProcessCommandLine has_any ("MSAcpi_ThermalZoneTemperature", "Win32_Fan")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 Image="*\\wmic.exe" (CommandLine="*MSAcpi_ThermalZoneTemperature*" OR CommandLine="*Win32_Fan*")
| table _time, host, User, CommandLine, ParentImage, ParentCommandLine
| sort - _timeHunt for non-VM-tool processes querying VM-related registry keys. Legitimate VM tools (vmtoolsd, VBoxService) access their own keys — other processes doing so indicates sandbox/VM detection behavior.
DeviceRegistryEvents
| where Timestamp > ago(7d)
| where RegistryKey has_any ("VMware", "VirtualBox", "VBoxGuest", "QEMU", "VEN_15AD", "VEN_80EE")
| where InitiatingProcessFileName !in~ ("vmtoolsd.exe", "VBoxService.exe", "MsMpEng.exe", "explorer.exe")
| project Timestamp, DeviceName, AccountName, RegistryKey, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=13 (TargetObject="*VMware*" OR TargetObject="*VirtualBox*" OR TargetObject="*VBoxGuest*" OR TargetObject="*QEMU*" OR TargetObject="*VEN_15AD*" OR TargetObject="*VEN_80EE*") NOT (Image="*vmtoolsd.exe" OR Image="*VBoxService.exe" OR Image="*MsMpEng.exe")
| table _time, host, User, Image, TargetObject
| sort - _timeHunt for known VM detection and anti-analysis testing tools (pafish, al-khaser, vmdetect.exe). While these are used by researchers, their presence on production endpoints is suspicious. Metamorfo malware has embedded vmdetect.exe.
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessCommandLine has_any ("vmdetect", "pafish", "al-khaser", "SandboxEvasion", "AntiVM")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (CommandLine="*vmdetect*" OR CommandLine="*pafish*" OR CommandLine="*al-khaser*" OR CommandLine="*SandboxEvasion*" OR CommandLine="*AntiVM*")
| table _time, host, User, Image, CommandLine, ParentImage
| sort - _timeAtomic Red Team Tests
Queries the WMI MSAcpi_ThermalZoneTemperature class to check for hardware temperature sensors. Virtual machines typically lack thermal zones, so an empty result indicates a VM. This exact WMI query is used by OopsIE (OilRig) and GravityRAT for sandbox evasion.
Command
wmic /namespace:\\root\WMI path MSAcpi_ThermalZoneTemperature get CurrentTemperatureExpected Telemetry
Sysmon Event ID 1: Process Create with Image=wmic.exe, CommandLine containing 'MSAcpi_ThermalZoneTemperature'. WMI trace log entry in Microsoft-Windows-WMI-Activity/Operational.
Expected Detection
Alert fires on 'MSAcpi_ThermalZoneTemperature' WMI query. KQL: WMICheck=true. SPL: WMIVMCheck=1, SuspicionScore >= 2.
Queries the Windows registry for VMware-related keys that indicate the presence of VMware virtual machine guest tools. Malware families like Bumblebee, SodaMaster, and DarkTortilla check for these keys before proceeding with their payload.
Command
reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools" 2>nul & reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest" 2>nulExpected Telemetry
Sysmon Event ID 1: Process Create with Image=reg.exe, CommandLine containing 'VMware' and 'VBoxGuest'. Sysmon Event ID 13: RegistryEvent for key access.
Expected Detection
Alert fires on reg.exe querying VMware/VirtualBox registry keys. KQL: RegistryCheck=true. SPL: RegistryVMCheck=1, SuspicionScore >= 2.
Uses tasklist to search for common security analysis tools (Wireshark, Process Monitor, debuggers) that indicate an analysis environment. QakBot, Lucifer, and WhisperGate check for these tools before executing their payloads.
Command
tasklist /FI "IMAGENAME eq wireshark.exe" & tasklist /FI "IMAGENAME eq procmon.exe" & tasklist /FI "IMAGENAME eq x64dbg.exe" & tasklist /FI "IMAGENAME eq ollydbg.exe"Expected Telemetry
Sysmon Event ID 1: Multiple Process Create events for tasklist.exe with filter arguments. Each tasklist invocation generates a separate process event.
Expected Detection
Alert fires on tasklist + analysis tool name pattern. KQL: ProcessScan=true. SPL: ProcessScan=1, SuspicionScore >= 2.