Techniques › T1497
T1497 Virtualization/Sandbox Evasion
stealth · discovery — Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
3
analytics
0
Sigma rules tagged attack.t1497
4
KEV CVEs mapped here
<p>Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from Virtualization/Sandbox Evasion during automated discovery to shape follow-on behaviors.</p><p>Adversaries may use several methods to accomplish Virtualization/Sandbox Evasion such as checking for security monitoring tools (e.g., Sysinternals, Wireshark, etc.) or other system artifacts associated with analysis or virtualization. Adversaries may also check for legitimate user activity to help determine if it is in an analysis environment. Additional methods include use of sleep timers or loops within malware code to avoid operating within a temporary sandbox.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2025-6558 | Google Chromium | primary impact | Mapped | 2025-07-22 |
| CVE-2025-2783 | Google Chromium Mojo | secondary impact | Mapped | 2025-03-27 |
| CVE-2014-0546 | Adobe Reader and Acrobat | primary impact | Mapped | 2022-05-25 |
| CVE-2015-3113 | Adobe Flash Player | secondary impact | Mapped | 2022-04-13 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0046 Detection Strategy for T1497 Virtualization/Sandbox Evasion v1.0
AN0127 WindowsExecution of discovery commands or API calls for virtualization artifacts (e.g., registry keys, device drivers, services), sleep/skipped execution behavior, or sandbox evasion DLLs before payload deployment.Tunable:
TimeWindowKnownVMArtifactListAN0128 LinuxExecution of commands to enumerate virtualization-related files or processes (e.g., '/sys/class/dmi/id/product_name', dmesg, lscpu, lspci), or querying hypervisor interfaces prior to malware execution.auditd:SYSCALLexecve or syscall invoking vm artifact check commands (e.g., dmidecode, lspci, dmesg)→ DC0032 Process Creationauditd:SYSCALLsleep function usage or loops (nanosleep, usleep) in scripts→ DC0064 Command ExecutionTunable:TimeWindowCommandArtifactMatchListAN0129 macOSExecution of scripts or binaries that check for virtualization indicators (e.g., system_profiler, ioreg -l, kextstat), combined with delay functions or anomalous launchd activity.macos:unifiedlogexecution of system_profiler, ioreg, kextstat with argument patterns related to VM/sandbox checks→ DC0032 Process Creationmacos:unifiedlogdynamic loading of sleep-related functions or sandbox detection libraries→ DC0016 Module LoadTunable:ProcessCommandPatternSleepThreshold
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1497
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content. 4 actively exploited CVEs map here.