tfMITRE ATT&CK technique

Virtualization/Sandbox Evasion T1497

Tactics: Stealth, Discovery
Platforms: Linux, macOS, Windows
Version: 2.0
Created: 17 April 2019
Last modified: 12 May 2026
Contributors: Deloitte Threat Library Team; Sunny Neo

Sub-techniques 313 rules across the family · 7 mapped directly to T1497 · 2 of 3 carry rules

.001System Checks3 .002User Activity Based Checks0 .003Time Based Checks3

Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from Virtualization/Sandbox Evasion during automated discovery to shape follow-on behaviors.[1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups64th pct

Threat groups64th percentile · 56% of ATT&CK techniques have fewer threat groups attributed.

Campaigns72nd pct

Campaigns72nd percentile · 54% of ATT&CK techniques have fewer campaigns recorded.

Tools & malwareTop 15%

Tools & malware85th percentile · 84% of ATT&CK techniques have fewer tools implementing them.

Detection rules69th pct

Detection rules69th percentile · 67% of ATT&CK techniques have fewer detection rules written.

Offense vs defense T1497

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 1Sigma rules (cumulative) · 0Splunk ESCU (cumulative) · 7

Data component	Name	Channel
Module LoadDC0016	WinEventLog:Sysmon	EventCode=7
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1

Data component

Name

Channel

Module LoadDC0016

WinEventLog:Sysmon

EventCode=7

Process CreationDC0032

WinEventLog:Sysmon

EventCode=1

Field	What you tune
TimeWindow	Time range in which multiple discovery processes or sleep/delay operations are executed to avoid sandbox detonation.
KnownVMArtifactList	Registry paths, DLLs, services or device names indicative of sandbox/VM environments.

Field

What you tune

TimeWindow

Time range in which multiple discovery processes or sleep/delay operations are executed to avoid sandbox detonation.

KnownVMArtifactList

Registry paths, DLLs, services or device names indicative of sandbox/VM environments.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve or syscall invoking vm artifact check commands (e.g., dmidecode, lspci, dmesg)
Command ExecutionDC0064	auditd:SYSCALL	sleep function usage or loops (nanosleep, usleep) in scripts

Field	What you tune
TimeWindow	Duration between VM discovery commands and payload execution
CommandArtifactMatchList	Command-line regex patterns indicative of sandbox evasion (e.g., grep QEMU, strings vmware)

Data component	Name	Channel
Module LoadDC0016	macos:unifiedlog	dynamic loading of sleep-related functions or sandbox detection libraries
Process CreationDC0032	macos:unifiedlog	execution of system_profiler, ioreg, kextstat with argument patterns related to VM/sandbox checks

Field	What you tune
ProcessCommandPattern	Detection regex or substring matching sandbox-related checks
SleepThreshold	Maximum duration of sleep execution before alert (e.g., > 5 minutes)

Offense vs defense T1497

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 1Sigma rules (cumulative) · 0Splunk ESCU (cumulative) · 7

Data component	Name	Channel
Module LoadDC0016	WinEventLog:Sysmon	EventCode=7
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1

Data component

Name

Channel

Module LoadDC0016

WinEventLog:Sysmon

EventCode=7

Process CreationDC0032

WinEventLog:Sysmon

EventCode=1

Field	What you tune
TimeWindow	Time range in which multiple discovery processes or sleep/delay operations are executed to avoid sandbox detonation.
KnownVMArtifactList	Registry paths, DLLs, services or device names indicative of sandbox/VM environments.

Field

What you tune

TimeWindow

Time range in which multiple discovery processes or sleep/delay operations are executed to avoid sandbox detonation.

KnownVMArtifactList

Registry paths, DLLs, services or device names indicative of sandbox/VM environments.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve or syscall invoking vm artifact check commands (e.g., dmidecode, lspci, dmesg)
Command ExecutionDC0064	auditd:SYSCALL	sleep function usage or loops (nanosleep, usleep) in scripts

Field	What you tune
TimeWindow	Duration between VM discovery commands and payload execution
CommandArtifactMatchList	Command-line regex patterns indicative of sandbox evasion (e.g., grep QEMU, strings vmware)

Data component	Name	Channel
Module LoadDC0016	macos:unifiedlog	dynamic loading of sleep-related functions or sandbox detection libraries
Process CreationDC0032	macos:unifiedlog	execution of system_profiler, ioreg, kextstat with argument patterns related to VM/sandbox checks

Field	What you tune
ProcessCommandPattern	Detection regex or substring matching sandbox-related checks
SleepThreshold	Maximum duration of sleep execution before alert (e.g., > 5 minutes)

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
Splunk	The following analytic detects the usage of headless browsers within an organization. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Stealth Hide Artifacts Hidden Window Stealth, Discovery Virtualization/Sandbox Evasion	-	medium	Michael Haag, Teoderick Contreras, Splunk	2023-09-11	2026-06-25	869ba261-c272-47d7-affe-5c0aa85c93d6
Splunk	The following analytic detects instances where a Chromium-based browser process, including Chrome, Edge, Brave, Opera, or Vivaldi, is launched with an unusually small window size, typically less than 100 pixels in width or height. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Stealth, Discovery Virtualization/Sandbox Evasion	-	medium	Teoderick Contreras, Splunk	2026-02-02	2026-05-13	88103f56-8f5c-411f-a87f-71bee776f140
Splunk	The following analytic detects instances where a Chrome or Chromium-based browser is launched with the --no-sandbox flag, a known indicator of potentially malicious or suspicious behavior. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Stealth, Discovery Virtualization/Sandbox Evasion	-	medium	Teoderick Contreras, Splunk	2025-05-28	2026-06-25	314cb263-7eeb-4d45-b693-bb21699c73d2
Splunk	The following analytic detects instances where the Chromium-based browser (e.g., Google Chrome, Microsoft Edge) is launched with the --user-data-dir command-line argument. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Stealth, Discovery Virtualization/Sandbox Evasion	-	medium	Teoderick Contreras, Splunk	2025-05-28	2026-06-25	4f546cf4-15aa-4368-80f7-940e92bc551e
Splunk	The following analytic detects instances where a Windows Chromium-based browser process is launched with the `--disable-popup-blocking` flag. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Stealth, Discovery Virtualization/Sandbox Evasion	-	medium	Teoderick Contreras, Splunk	2026-02-02	2026-05-13	95f8acd6-978e-42d6-99c1-85baacdd2b46
Splunk	The following analytic detects instances of Chromium-based browser processes on Windows launched with logging disabled via command-line arguments such as --disable-logging and --disable-logging-redirect. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Stealth, Discovery Virtualization/Sandbox Evasion	-	medium	Teoderick Contreras, Splunk	2026-02-02	2026-05-13	d31de944-4e61-468f-9154-e50690f0e99e
Splunk	The following analytic detects instances of Chromium-based browser processes on Windows launched with extensions explicitly disabled via command-line arguments. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Stealth, Discovery Virtualization/Sandbox Evasion	-	medium	Teoderick Contreras, Splunk	2026-02-02	2026-05-13	ce245717-779b-483b-bc52-fc7a94729973

Title

Description

Virtualization/Sandbox Evasion T1497

Virtualization/Sandbox Evasion T1497

Virtualization/Sandbox Evasion MITRE reference T1497

Offense vs defense T1497

Virtualization/Sandbox Evasion detection strategy DET0046

Detection Strategy for T1497 Virtualization/Sandbox Evasion

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Virtualization/Sandbox Evasion MITRE reference T1497

Offense vs defense T1497

Virtualization/Sandbox Evasion detection strategy DET0046

Detection Strategy for T1497 Virtualization/Sandbox Evasion

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Virtualization/Sandbox Evasion detections T1497

Virtualization/Sandbox Evasion detections T1497