TA0005 · DEFENSE EVASION
System Checks
Adversaries may employ various system checks to detect and avoid virtualization and analysis environments.
Detect it with
Virtualization/sandbox related system checks will likely occur in the first steps of an operation but may also occur throughout as an adversary learns the environment.
Why it matters on shift
System Checks is one of the concrete ways adversaries achieve defense evasion. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After defense evasion, the next tactic is usually Credential Access. Search your telemetry for the transition before closing the ticket.
Kill-chain context