T1497.001 — System Checks

Tactics: Stealth, Discovery · Platforms: Linux, macOS, Windows

Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME,…

Sub-technique of Virtualization/Sandbox Evasion (T1497).

Sigma detection rules (3)

T1497.001 Virtualization/Sandbox Evasion: System Checks

title: "T1497.001 Virtualization/Sandbox Evasion: System Checks"
id: 86e79f0d-23ec-4918-bc9f-41129ad6fcf1
description: 'Virtualization/Sandbox Evasion via System Checks: detects command-line enumeration of VM/sandbox-indicative hardware, BIOS, and service artifacts (WMI computersystem/bios queries, VirtualBox/VMware registry lookups, VM guest-service queries). (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: TimeWindow, ProcessAncestry, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1497/001
author: Shahrukh Khan
date: 2026-03-24
license: MIT
tags:
  - attack.stealth
  - attack.discovery
  - attack.t1497.001

logsource:
  category: process_creation
  product: windows

detection:
  selection_wmic:
    Image|endswith: '\wmic.exe'
    CommandLine|contains:
      - 'computersystem get model'
      - 'bios get serialnumber'
      - 'baseboard get product'
      - 'path win32_computersystem get'
  selection_reg:
    Image|endswith: '\reg.exe'
    CommandLine|contains:
      - 'VirtualBox'
      - 'VMware'
      - 'Virtual Machine'
      - 'VBOX'
  selection_sc:
    Image|endswith: '\sc.exe'
    CommandLine|contains:
      - 'VBoxService'
      - 'VMTools'
      - 'vmicheartbeat'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: 1 of selection_* and not filter_system_account

falsepositives:
  - IT asset-inventory or hardware-inventory scripts querying the same WMI/registry/service artifacts; System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account; tune further with process/path allowlists if noise remains.

level: medium

T1497.001 Virtualization/Sandbox Evasion: System Checks

title: "T1497.001 Virtualization/Sandbox Evasion: System Checks"
id: c0cae6ba-4721-4606-9d60-624c1f850989
description: 'Virtualization/Sandbox Evasion via System Checks across Windows, Linux, macOS. Fixed an argv-position bug: the real invocation "dmidecode -s system-product-name" places -s at a1 and the value at a2, but the prior selection checked a1 for the string, so it would rarely if ever match. Now checks a2. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: TimeWindow, CommandPattern.'
references:
  - https://attack.mitre.org/techniques/T1497/001
author: Shahrukh Khan
date: 2026-06-17
license: MIT
tags:
  - attack.stealth
  - attack.discovery
  - attack.t1497.001

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith: '/systemd-detect-virt'
  selection_dmi:
    type: EXECVE
    a0|endswith: '/dmidecode'
    a1: '-s'
    a2|contains: 'system-product-name'

  condition: 1 of selection*

falsepositives:
  - Legitimate provisioning/monitoring scripts routinely check virtualization status; time-window burst correlation (tune TimeWindow) is required to separate a single benign check from a malware sandbox-evasion probe sequence.

level: informational

T1497.001 Virtualization/Sandbox Evasion: System Checks

title: "T1497.001 Virtualization/Sandbox Evasion: System Checks"
id: 5eca22f4-5510-441d-bb21-a5dcdb270572
description: 'Virtualization/Sandbox Evasion via System Checks across Windows, Linux, macOS. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ExecutionBurst, ToolName.'
references:
  - https://attack.mitre.org/techniques/T1497/001
author: Shahrukh Khan
date: 2026-04-13
license: MIT
tags:
  - attack.stealth
  - attack.discovery
  - attack.t1497.001

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/system_profiler'
      - '/ioreg'
  selection_args:
    CommandLine|contains:
      - 'SPEthernetDataType'
      - 'VBox'
      - 'VMware'
      - 'Parallels'
  condition: selection and selection_args

falsepositives:
  - Software licensing and diagnostic tools legitimately check for virtualization indicators when generating support bundles, so this alone does not confirm sandbox evasion intent.

level: informational

Related sub-techniques

Explore