Applied Cybernetics Group
T1497 — Virtualization/Sandbox Evasion
coverage gap
- Technique
T1497- Tactics
- Defense Evasion, Discovery
- MISP citations
- 0
- KEV CVEs mapped
- 4
- Community rules
- 0
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1497
MITRE description
Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.(Citation: Deloitte Environment Awareness) Adversaries may use several methods to accomplish [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) such as checking for security monitoring tools (e.g., Sysinternals, Wireshark, etc.) or other system artifacts associated with analysis or virtualization. Adversaries may also check for legitimate user activity to help determine if it is in an analysis environment. Additional methods include use of sleep timers or loops within malware code to avoid operating within a temporary sandbox.(Citation: Unit 42 Pirpi July 2015)
KEV CVEs mapped to this technique
Per MITRE CTID's hand-curated KEV→ATT&CK mappings — these are the actively-exploited vulnerabilities behind this technique's KEV signal.
Detection coverage
child-covered by community rules (T1497.001); remainder is in-process API behavior invisible to base Sigma
The Sigma-visible expression of sandbox evasion is the system-check procedure — VM-artifact queries through commands, scripts, and registry reads — and the community already covers that at the child level: T1497.001 carries 'Powershell Detect Virtualization Environment' on Windows plus the macOS sysctl and system_profiler discovery pair. The uncovered children are structurally invisible to base Sigma: T1497.002 user-activity checks and T1497.003 time-based evasion are in-process behaviors — sleep loops, tick-count deltas, cursor polling, CPUID/RDTSC — that emit no discrete OS log event on any standard logsource; that is EDR and sandbox-instrumentation territory, not field matching. The KEV CVEs the CTID mapping attaches to this technique (Chromium Mojo CVE-2025-2783, Chromium ANGLE CVE-2025-6558, legacy Adobe Flash CVE-2015-3113 and Reader CVE-2014-0546) are software sandbox escapes — a different behavior class from VM-detection checks — and are patch-currency and per-exploit-signature problems rather than parent-technique behavioral detections. A parent T1497 rule would either restate the existing child rules or claim visibility into API-level behavior the telemetry does not record. Rejected: child-covered where visible, wrong control class where not.
Compensating controls
- Deploy the existing T1497.001 community rules (PowerShell script-block VM checks; macOS sysctl/system_profiler discovery)
- EDR behavioral/memory instrumentation for evasion API patterns (sleep-skew, CPUID/RDTSC probing)
- Sandbox-vendor anti-evasion hardening: time acceleration, artifact camouflage, human-activity simulation
- Browser and OS patch currency for the KEV sandbox-escape CVEs backing this signal
Revisit when: MISP or family evidence of a recurring command-line/registry VM-check procedure not matched by the existing T1497.001 rules (e.g., a campaign standardizing on wmic/systeminfo/driver-file artifact checks) — and that rule would be authored under T1497.001, not the parent.