T1497.001 Virtualization/Sandbox Evasion: System Checks

Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. MITRE ATT&CK

1 program on CmdID 2 Sigma rules T1497.001 on attack.mitre.org

Part of

MITRE ATT&CK

T1497Virtualization/Sandbox Evasion

documented by LOLBAS and GTFOBins, or named by its rules

process creation, the highest levels first

mediumSystem Information Discovery Using System_ProfilerStephen Lincoln `@slincoln_aiq` (AttackIQ) · macOS

everyday examples from tldr-pages, CC BY 4.0

Display a hardware overview (Model, CPU, Memory, Serial, etc.) and software data (System, Kernel, Name, Uptime, etc.) on the page for system_profiler

system_profiler SPHardwareDataType SPSoftwareDataTypeIdentify

Print the system serial number on the page for system_profiler

system_profiler SPHardwareDataType|grep "Serial Number (system)" | awk '{ print $4 }'Identify

An example is here when CmdID’s reading of it names T1497.001: a Sigma rule it trips is tagged with it, or its abuse is documented as it.