T1497 Virtualization/Sandbox Evasion

Technique: T1497
Tactics: Defense Evasion, Discovery
Research, 90 days: 4
KEV CVEs mapped: 4
SigmaHQ rules: 0
Elastic, Splunk: 12
thrunt rules: 0
Upstream: https://attack.mitre.org/techniques/T1497

MITRE description

Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.(Citation: Deloitte Environment Awareness) Adversaries may use several methods to accomplish [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) such as checking for security monitoring tools (e.g., Sysinternals, Wireshark, etc.) or other system artifacts associated with analysis or virtualization. Adversaries may also check for legitimate user activity to help determine if it is in an analysis environment. Additional methods include use of sleep timers or loops within malware code to avoid operating within a temporary sandbox.(Citation: Unit 42 Pirpi July 2015)

KEV CVEs mapped to this technique

MITRE CTID maps these KEV CVEs to this technique by hand. They are the actively exploited vulnerabilities behind this technique's KEV signal.

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

2026-10-14 Group-IB: KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and Terrorize
2026-09-14 Group-IB: Smish. Click. Drained: Inside the Smishing Triad’s Phishing Cockpit
2026-09-03 Group-IB: The Outsider Phishing Kit: A Resilient Threat in the Face of Law Enforcement Action
2026-08-13 Recorded Future Insikt: Malware Crypting Services and the Threat Actors Who Sell Them

Detection coverage

No thrunt rule, on purpose rejected

child-covered by community rules (T1497.001); remainder is in-process API behavior invisible to base Sigma

The Sigma-visible expression of sandbox evasion is the system-check procedure, VM-artifact queries through commands, scripts, and registry reads, and the community already covers that at the child level: T1497.001 carries 'Powershell Detect Virtualization Environment' on Windows plus the macOS sysctl and system_profiler discovery pair. The uncovered children are structurally invisible to base Sigma: T1497.002 user-activity checks and T1497.003 time-based evasion are in-process behaviors, sleep loops, tick-count deltas, cursor polling, CPUID/RDTSC, that emit no discrete OS log event on any standard logsource; that is EDR and sandbox-instrumentation territory, not field matching. The KEV CVEs the CTID mapping attaches to this technique (Chromium Mojo CVE-2025-2783, Chromium ANGLE CVE-2025-6558, legacy Adobe Flash CVE-2015-3113 and Reader CVE-2014-0546) are software sandbox escapes, a different behavior class from VM-detection checks, and are patch-currency and per-exploit-signature problems rather than parent-technique behavioral detections. A parent T1497 rule would either restate the existing child rules or claim visibility into API-level behavior the telemetry does not record. Rejected: child-covered where visible, wrong control class where not.

Compensating controls

Deploy the existing T1497.001 community rules (PowerShell script-block VM checks; macOS sysctl/system_profiler discovery)
EDR behavioral/memory instrumentation for evasion API patterns (sleep-skew, CPUID/RDTSC probing)
Sandbox-vendor anti-evasion hardening: time acceleration, artifact camouflage, human-activity simulation
Browser and OS patch currency for the KEV sandbox-escape CVEs backing this signal

Revisit when: Research or family evidence of a recurring command-line/registry VM-check procedure not matched by the existing T1497.001 rules (e.g., a campaign standardizing on wmic/systeminfo/driver-file artifact checks): and that rule would be authored under T1497.001, not the parent.

Elastic and Splunk rules

Virtual Machine Fingerprinting via Grep (elastic)
Virtual Machine Fingerprinting (elastic)
Potential Microsoft Office Sandbox Evasion (elastic)
Suspicious SIP Check by macOS Application (elastic)
Delayed Execution via Ping (elastic)
Headless Browser Usage (splunk)
Windows Chromium Browser Launched with Small Window Size (splunk)
Windows Chromium Browser No Security Sandbox Process (splunk)
Windows Chromium Browser with Custom User Data Directory (splunk)
Windows Chromium process Launched with Disable Popup Blocking (splunk)
Windows Chromium Process Launched with Logging Disabled (splunk)
Windows Chromium Process with Disabled Extensions (splunk)

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.