Contagious InterviewG1052 ↗
Has requested victims to disable Docker and other container environments in attempts to thwart container isolation and ensure device infection.1
tfMITRE ATT&CK technique
Virtualization/Sandbox Evasion T1497
- Platforms
- Linux, macOS, Windows
- Version
- 2.0
- Created
- 17 April 2019
- Last modified
- 12 May 2026
- Contributors
- Deloitte Threat Library Team; Sunny Neo
Sub-techniques 313 rules across the family · 7 mapped directly to T1497 · 2 of 3 carry rules
Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from Virtualization/Sandbox Evasion during automated discovery to shape follow-on behaviors.[1]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
3
Threat groups64th pct
Threat groups64th percentile · 64% of ATT&CK techniques have this many threat groups attributed or fewer.1
Campaigns72nd pct
Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.23
Tools & malwareTop 15%
Tools & malware85th percentile · 85% of ATT&CK techniques have this many tools implementing them or fewer.7
Detection rules69th pct
Detection rules69th percentile · 69% of ATT&CK techniques have this many detection rules written or fewer.Virtualization/Sandbox Evasion MITRE reference T1497
64th pctamong all ATT&CK techniques for number of groups
3 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Saint BearG1031 ↗
Contains several anti-analysis and anti-virtualization checks.1
DarkhotelG0012 ↗
Malware has employed just-in-time decryption of strings to evade sandbox detection.1
All 3 groups for this technique
1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
Operation SpalaxC0005 ↗
During Operation Spalax, the threat actors used droppers that would run anti-analysis checks before executing malware on a compromised host.1
All 1 campaigns for this technique
23 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Mini Shai-HuludS9043 ↗
Has evaded sandbox detection by applying a 1-in-6 probability gate that generates a random number which will only trigger the wiper functionality when the set number outcome is met even in environments that match parameters of a geopolitical target.1
RedLine StealerS1240 ↗
Has an anti-sandbox technique that requires the malware to consistently check with the C2 server, if the communication fails RedLine Stealer will not continue execution.1
XLoaderS1207 ↗
Can utilize decoy command and control domains within the malware configuration to circumvent sandbox analysis.12
StrelaStealerS1183 ↗
Payloads have used control flow obfuscation techniques such as excessively long code blocks of mathematical instructions to defeat sandboxing and related analysis methods.12
Raspberry RobinS1130 ↗
Contains real and fake second-stage payloads following initial execution, with the real payload only delivered if the malware determines it is not running in a virtualized environment.1
Black BastaS1070 ↗
Can make a random number of calls to the kernel32.beep function to hinder log analysis.1
All 23 software entries for this technique · 6 newest in this preview
Offense vs defense T1497
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 1Sigma rules (cumulative) · 0Splunk ESCU (cumulative) · 7
first rule: 2023 Q3 · 1 of 1 campaigns plottedVirtualization/Sandbox Evasion detection strategy DET0046
MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for T1497 Virtualization/Sandbox Evasion
3 platforms
AN0127 · Windows
Execution of discovery commands or API calls for virtualization artifacts (e.g., registry keys, device drivers, services), sleep/skipped execution behavior, or sandbox evasion DLLs before payload deployment.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Module LoadDC0016 | WinEventLog:Sysmon | EventCode=7 |
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | Time range in which multiple discovery processes or sleep/delay operations are executed to avoid sandbox detonation. |
| KnownVMArtifactList | Registry paths, DLLs, services or device names indicative of sandbox/VM environments. |
AN0128 · Linux
Execution of commands to enumerate virtualization-related files or processes (e.g., '/sys/class/dmi/id/product_name', dmesg, lscpu, lspci), or querying hypervisor interfaces prior to malware execution.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:SYSCALL | execve or syscall invoking vm artifact check commands (e.g., dmidecode, lspci, dmesg) |
| Command ExecutionDC0064 | auditd:SYSCALL | sleep function usage or loops (nanosleep, usleep) in scripts |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | Duration between VM discovery commands and payload execution |
| CommandArtifactMatchList | Command-line regex patterns indicative of sandbox evasion (e.g., grep QEMU, strings vmware) |
AN0129 · macOS
Execution of scripts or binaries that check for virtualization indicators (e.g., system_profiler, ioreg -l, kextstat), combined with delay functions or anomalous launchd activity.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Module LoadDC0016 | macos:unifiedlog | dynamic loading of sleep-related functions or sandbox detection libraries |
| Process CreationDC0032 | macos:unifiedlog | execution of system_profiler, ioreg, kextstat with argument patterns related to VM/sandbox checks |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ProcessCommandPattern | Detection regex or substring matching sandbox-related checks |
| SleepThreshold | Maximum duration of sleep execution before alert (e.g., > 5 minutes) |