MITRE ATT&CKsub-technique

T1497.001 System Checks

Published 2020-03-06 Modified 2026-09-11 Official page ↗
Domain
enterprise
Tactics
Stealth, Discovery
Platforms
Linux, macOS, Windows
Version
3.0
Created
2020-03-06

Description

Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from Virtualization/Sandbox Evasion during automated discovery to shape follow-on behaviors. Specific checks will vary based on the target and/or adversary, but may involve behaviors such as Windows Management Instrumentation, PowerShell, System Information Discovery, and Query Registry to obtain system information and search for VME artifacts. Adversaries may search for VME artifacts in memory, processes, file system, hardware, and/or the Registry. Adversaries may use scripting to automate these checks into one script and then have the program exit if it determines the system to be a virtual environment. Checks could include generic system properties such as host/domain name and samples of network traffic. Adversaries may also check the network adapters addresses, CPU core count, and available memory/drive size. Once executed, malware may also use File and Directory Discovery to check if it was saved in a folder or file with unexpected or even analysis-related naming artifacts such as `malware`, `sample`, or `hash`. Other common checks may enumerate services running that are unique to these applications, installed programs on the system, manufacturer/product fields for strings relating to virtual machine applications, and VME-specific hardware/processor instructions. In applications like VMWare, adversaries can also use a special I/O port to send commands and receive output. Hardware checks, such as the presence of the fan, temperature, and audio devices, could also be used to gather evidence that can be indicative a virtual environment. Adversaries may also query for specific readings from these devices.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1497 Virtualization/Sandbox Evasion technique

Tactic · MITRE ATT&CK (2)

Referenced by MITRE ATT&CK · uses (72)

  • S9060 MiniBus software (malware)
  • S9050 Vidar software (malware)
  • S9043 Mini Shai-Hulud software (malware)
  • S9018 HeartCrypt software (malware)
  • S1213 Lumma Stealer software (malware)
  • S1207 XLoader software (malware)
  • S1179 Exbyte software (malware)
  • S1180 BlackByte Ransomware software (malware)
  • S1159 DUSTTRAP software (malware)
  • S1160 Latrodectus software (malware)
  • S1147 Nightdoor software (malware)
  • S1145 Pikabot software (malware)
  • S1130 Raspberry Robin software (malware)
  • S1122 Mispadu software (malware)
  • S1111 DarkGate software (malware)
  • S1087 AsyncRAT software (tool)
  • S1086 Snip3 software (malware)
  • G1017 Volt Typhoon group
  • C0022 Operation Dream Job campaign
  • S1070 Black Basta software (malware)
  • S1066 DarkTortilla software (malware)
  • S1064 SVCReady software (malware)
  • S1048 macOS.OSAMiner software (malware)
  • C0001 Frankenstein campaign
  • S1039 Bumblebee software (malware)
  • S1019 Shark software (malware)
  • S1018 Saint Bot software (malware)
  • S0689 WhisperGate software (malware)
  • S0679 Ferocious software (malware)
  • S0657 BLUELIGHT software (malware)
Show all 72 ›

References