TA0005 · DEFENSE EVASION
Virtualization/Sandbox Evasion
Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox.
Detect it with
Virtualization, sandbox, user activity, and related discovery techniques will likely occur in the first steps of an operation but may also occur throughout as an adversary learns the environment.
Why it matters on shift
Virtualization/Sandbox Evasion is one of the concrete ways adversaries achieve defense evasion. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After defense evasion, the next tactic is usually Credential Access. Search your telemetry for the transition before closing the ticket.
3 sub-techniques
How it shows up in practice
- T1497.001
System Checks
Adversaries may employ various system checks to detect and avoid virtualization and analysis environments.
- T1497.002
User Activity Based Checks
Adversaries may employ various user activity checks to detect and avoid virtualization and analysis environments.
- T1497.003
Time Based Evasion
Adversaries may employ various time-based methods to detect and avoid virtualization and analysis environments.
Kill-chain context