{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1497","id":"T1497","name":"Virtualization/Sandbox Evasion","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1497","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"c2dd2d8959ccef93db4201cb8e3db2e9887147b5ec0d6cdf1323d15f9297c6bf","description":"Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.(Citation: Deloitte Environment Awareness)\n\nAdversaries may use several methods to accomplish [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) such as checking for security monitoring tools (e.g., Sysinternals, Wireshark, etc.) or other system artifacts associated with analysis or virtualization. Adversaries may also check for legitimate user activity to help determine if it is in an analysis environment. Additional methods include use of sleep timers or loops within malware code to avoid operating within a temporary sandbox.(Citation: Unit 42 Pirpi July 2015)\n\n","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1497","external_id":"T1497"},{"source_name":"Unit 42 Pirpi July 2015","description":"Falcone, R., Wartell, R.. (2015, July 27). UPS: Observations on CVE-2015-3113, Prior Zero-Days and the Pirpi Payload. Retrieved April 23, 2019.","url":"https://unit42.paloaltonetworks.com/ups-observations-on-cve-2015-3113-prior-zero-days-and-the-pirpi-payload/"},{"source_name":"Deloitte Environment Awareness","description":"Torello, A. & Guibernau, F. (n.d.). Environment Awareness. Retrieved September 13, 2024.","url":"https://drive.google.com/file/d/1t0jn3xr4ff2fR30oQAUn_RsWSnMpOAQc/edit"}],"platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1497.001","id":"T1497.001","name":"System Checks","page":"techniques/enterprise/T1497.001/"},{"key":"enterprise/T1497.002","id":"T1497.002","name":"User Activity Based Checks","page":"techniques/enterprise/T1497.002/"},{"key":"enterprise/T1497.003","id":"T1497.003","name":"Time Based Checks","page":"techniques/enterprise/T1497.003/"}],"telemetry":[{"id":"DC0064","name":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component","category":"Script and command execution","description":"Execution of a command and its interpreter or parent context.","collection_focus":"Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.","providers":[{"name":"PowerShell Script Block Logging","scope":"Script content via event 4104 when configured; channel depends on PowerShell edition.","source_id":"powershell"},{"name":"Sysmon process events","scope":"Interpreter launch and parent context, not full script content.","source_id":"sysmon"},{"name":"Linux Audit","scope":"execve-family execution context; shell built-ins need additional instrumentation.","source_id":"linux"}],"configuration":["Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.","Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.","On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records."],"configuration_example":null,"required_fields":["interpreter","command_line","actor_uid","session_id"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.","sources":[{"id":"powershell","title":"Microsoft PowerShell logging on Windows","url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5"},{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility."},{"id":"DC0016","name":"Module Load","page":"telemetry/DC0016/","kind":"attack_component","category":"Endpoint activity","description":"A module or library being loaded into a running process.","collection_focus":"Scope Sysmon ImageLoad (7) to lab processes/paths; retain module hash, signer and destination process. Inventory alone does not prove a module loaded.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_id","image_loaded","signed","action"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0016","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image_loaded":"C:\\Lab\\demo.dll","signed":false,"action":"load"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1497","id":"T1497","name":"Virtualization/Sandbox Evasion","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"source_url":"https://attack.mitre.org/techniques/T1497","technique_page":"techniques/enterprise/T1497/","page":"detections/enterprise/T1497/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0046","name":"Detection Strategy for T1497 Virtualization/Sandbox Evasion","url":"https://attack.mitre.org/detectionstrategies/DET0046","stix_id":"x-mitre-detection-strategy--7f5dde79-7872-48dd-8718-cd2e10d7cbfc","relationship_id":"relationship--3a1c35eb-615c-4c4a-98ee-ca2b9d25fb01","description":"","analytics":[{"id":"AN0127","name":"Analytic 0127","guidance":"Execution of discovery commands or API calls for virtualization artifacts (e.g., registry keys, device drivers, services), sleep/skipped execution behavior, or sandbox evasion DLLs before payload deployment.","url":"https://attack.mitre.org/detectionstrategies/DET0046#AN0127","platforms":["Windows"],"tuning":[{"field":"TimeWindow","description":"Time range in which multiple discovery processes or sleep/delay operations are executed to avoid sandbox detonation."},{"field":"KnownVMArtifactList","description":"Registry paths, DLLs, services or device names indicative of sandbox/VM environments."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN0127","source_url":"https://attack.mitre.org/detectionstrategies/DET0046#AN0127","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0016","component":"Module Load","name":"WinEventLog:Sysmon","channel":"EventCode=7","platforms":["Windows"],"analytic_id":"AN0127","source_url":"https://attack.mitre.org/detectionstrategies/DET0046#AN0127","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0016/"}]},{"id":"AN0128","name":"Analytic 0128","guidance":"Execution of commands to enumerate virtualization-related files or processes (e.g., '/sys/class/dmi/id/product_name', dmesg, lscpu, lspci), or querying hypervisor interfaces prior to malware execution.","url":"https://attack.mitre.org/detectionstrategies/DET0046#AN0128","platforms":["Linux"],"tuning":[{"field":"TimeWindow","description":"Duration between VM discovery commands and payload execution"},{"field":"CommandArtifactMatchList","description":"Command-line regex patterns indicative of sandbox evasion (e.g., grep QEMU, strings vmware)"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"execve or syscall invoking vm artifact check commands (e.g., dmidecode, lspci, dmesg)","platforms":["Linux"],"analytic_id":"AN0128","source_url":"https://attack.mitre.org/detectionstrategies/DET0046#AN0128","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0064","component":"Command Execution","name":"auditd:SYSCALL","channel":"sleep function usage or loops (nanosleep, usleep) in scripts","platforms":["Linux"],"analytic_id":"AN0128","source_url":"https://attack.mitre.org/detectionstrategies/DET0046#AN0128","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"}]},{"id":"AN0129","name":"Analytic 0129","guidance":"Execution of scripts or binaries that check for virtualization indicators (e.g., system_profiler, ioreg -l, kextstat), combined with delay functions or anomalous launchd activity.","url":"https://attack.mitre.org/detectionstrategies/DET0046#AN0129","platforms":["macOS"],"tuning":[{"field":"ProcessCommandPattern","description":"Detection regex or substring matching sandbox-related checks"},{"field":"SleepThreshold","description":"Maximum duration of sleep execution before alert (e.g., > 5 minutes)"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"macos:unifiedlog","channel":"execution of system_profiler, ioreg, kextstat with argument patterns related to VM/sandbox checks","platforms":["macOS"],"analytic_id":"AN0129","source_url":"https://attack.mitre.org/detectionstrategies/DET0046#AN0129","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0016","component":"Module Load","name":"macos:unifiedlog","channel":"dynamic loading of sleep-related functions or sandbox detection libraries","platforms":["macOS"],"analytic_id":"AN0129","source_url":"https://attack.mitre.org/detectionstrategies/DET0046#AN0129","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0016/"}]}]}],"telemetry_references":[{"id":"DC0064","name":"Command Execution","tag":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component"},{"id":"DC0016","name":"Module Load","tag":"Module Load","page":"telemetry/DC0016/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0023","name":"CHOPSTICK","url":"https://attack.mitre.org/software/S0023","kind":"malware","description":"[CHOPSTICK](https://attack.mitre.org/software/S0023)  includes runtime checks to identify an analysis environment and prevent execution on it.(Citation: FireEye APT28)","relationship_id":"relationship--5edc2d20-2e9a-4587-9656-dfe38eb1d66d","references":[{"source_name":"FireEye APT28","description":"FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.","url":"https://web.archive.org/web/20151022204649/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf"}]},{"id":"S0046","name":"CozyCar","url":"https://attack.mitre.org/software/S0046","kind":"malware","description":"Some versions of [CozyCar](https://attack.mitre.org/software/S0046) will check to ensure it is not being executed inside a virtual machine or a known malware analysis sandbox environment. If it detects that it is, it will exit.(Citation: F-Secure CozyDuke)","relationship_id":"relationship--8f88490e-346b-4462-b077-0211707c21a3","references":[{"source_name":"F-Secure CozyDuke","description":"F-Secure Labs. (2015, April 22). CozyDuke: Malware Analysis. Retrieved December 10, 2015.","url":"https://www.f-secure.com/documents/996508/1030745/CozyDuke"}]},{"id":"S0147","name":"Pteranodon","url":"https://attack.mitre.org/software/S0147","kind":"malware","description":"[Pteranodon](https://attack.mitre.org/software/S0147) has the ability to use anti-detection functions to identify sandbox environments.(Citation: Unit 42 Gamaredon February 2022)","relationship_id":"relationship--c9a7b01c-5ba6-41db-944a-ed5ba8531398","references":[{"source_name":"Unit 42 Gamaredon February 2022","description":"Unit 42. (2022, February 3). Russia’s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine. Retrieved February 21, 2022.","url":"https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"}]},{"id":"S0148","name":"RTM","url":"https://attack.mitre.org/software/S0148","kind":"malware","description":"[RTM](https://attack.mitre.org/software/S0148) can detect if it is running within a sandbox or other virtualized analysis environment.(Citation: Unit42 Redaman January 2019)\t","relationship_id":"relationship--73d5e6ab-9d0c-4884-9db0-02033523e61a","references":[{"source_name":"Unit42 Redaman January 2019","description":"Duncan, B., Harbison, M. (2019, January 23). Russian Language Malspam Pushing Redaman Banking Malware. Retrieved June 16, 2020.","url":"https://unit42.paloaltonetworks.com/russian-language-malspam-pushing-redaman-banking-malware/"}]},{"id":"S0268","name":"Bisonal","url":"https://attack.mitre.org/software/S0268","kind":"malware","description":"[Bisonal](https://attack.mitre.org/software/S0268) can check to determine if the compromised system is running on VMware.(Citation: Talos Bisonal Mar 2020)","relationship_id":"relationship--20dfecf8-b324-4584-9526-9de6a14dfa27","references":[{"source_name":"Talos Bisonal Mar 2020","description":"Mercer, W., et al. (2020, March 5). Bisonal: 10 years of play. Retrieved January 26, 2022.","url":"https://blog.talosintelligence.com/2020/03/bisonal-10-years-of-play.html"}]},{"id":"S0331","name":"Agent Tesla","url":"https://attack.mitre.org/software/S0331","kind":"malware","description":" [Agent Tesla](https://attack.mitre.org/software/S0331) has the ability to perform anti-sandboxing and anti-virtualization checks.(Citation: Malwarebytes Agent Tesla April 2020)","relationship_id":"relationship--061f0d25-40fd-440a-b7e8-54ad0209f5f4","references":[{"source_name":"Malwarebytes Agent Tesla April 2020","description":"Jazi, H. (2020, April 16). New AgentTesla variant steals WiFi credentials. Retrieved May 19, 2020.","url":"https://blog.malwarebytes.com/threat-analysis/2020/04/new-agenttesla-variant-steals-wifi-credentials/"}]},{"id":"S0380","name":"StoneDrill","url":"https://attack.mitre.org/software/S0380","kind":"malware","description":"[StoneDrill](https://attack.mitre.org/software/S0380) has used several anti-emulation techniques to prevent automated analysis by emulators or sandboxes.(Citation: Kaspersky StoneDrill 2017)\t","relationship_id":"relationship--02a35538-7a82-4b30-94ac-e943c19acfe4","references":[{"source_name":"Kaspersky StoneDrill 2017","description":"Kaspersky Lab. (2017, March 7). From Shamoon to StoneDrill: Wipers attacking Saudi organizations and beyond. Retrieved March 14, 2019.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07180722/Report_Shamoon_StoneDrill_final.pdf"}]},{"id":"S0455","name":"Metamorfo","url":"https://attack.mitre.org/software/S0455","kind":"malware","description":"[Metamorfo](https://attack.mitre.org/software/S0455) has embedded a \"vmdetect.exe\" executable to identify virtual machines at the beginning of execution.(Citation: Medium Metamorfo Apr 2020) ","relationship_id":"relationship--6176ae5b-cd96-4b15-8539-5fb6e230fd5d","references":[{"source_name":"Medium Metamorfo Apr 2020","description":"Erlich, C. (2020, April 3). The Avast Abuser: Metamorfo Banking Malware Hides By Abusing Avast Executable. Retrieved May 26, 2020.","url":"https://medium.com/@chenerlich/the-avast-abuser-metamorfo-banking-malware-hides-by-abusing-avast-executable-ac9b8b392767"}]},{"id":"S0483","name":"IcedID","url":"https://attack.mitre.org/software/S0483","kind":"malware","description":"[IcedID](https://attack.mitre.org/software/S0483) has manipulated Keitaro Traffic Direction System to filter researcher and sandbox traffic.(Citation: Trendmicro_IcedID)","relationship_id":"relationship--03351a2c-8fa5-4a1a-9ad5-a8be376a06c8","references":[{"source_name":"Trendmicro_IcedID","description":"Kenefick , I. (2022, December 23). IcedID Botnet Distributors Abuse Google PPC to Distribute Malware. Retrieved July 24, 2024.","url":"https://www.trendmicro.com/en_us/research/22/l/icedid-botnet-distributors-abuse-google-ppc-to-distribute-malware.html"}]},{"id":"S0484","name":"Carberp","url":"https://attack.mitre.org/software/S0484","kind":"malware","description":"[Carberp](https://attack.mitre.org/software/S0484) has removed various hooks before installing the trojan or bootkit to evade sandbox analysis or other analysis software.(Citation: ESET Carberp March 2012)","relationship_id":"relationship--2c112e41-be75-4f99-84ac-ce7776f88fca","references":[{"source_name":"ESET Carberp March 2012","description":"Matrosov, A., Rodionov, E., Volkov, D., Harley, D. (2012, March 2). Win32/Carberp When You’re in a Black Hole, Stop Digging. Retrieved July 15, 2020.","url":"https://www.eset.com/fileadmin/eset/US/resources/docs/white-papers/white-papers-win-32-carberp.pdf"}]},{"id":"S0499","name":"Hancitor","url":"https://attack.mitre.org/software/S0499","kind":"malware","description":"[Hancitor](https://attack.mitre.org/software/S0499) has used a macro to check that an ActiveDocument shape object in the lure message is present. If this object is not found, the macro will exit without downloading additional payloads.(Citation: FireEye Hancitor)","relationship_id":"relationship--f60f8552-3c43-4b43-ad23-2b00b6172b00","references":[{"source_name":"FireEye Hancitor","description":"Anubhav, A., Jallepalli, D. (2016, September 23). Hancitor (AKA Chanitor) observed using multiple attack approaches. Retrieved August 13, 2020.","url":"https://www.fireeye.com/blog/threat-research/2016/09/hancitor_aka_chanit.html"}]},{"id":"S0534","name":"Bazar","url":"https://attack.mitre.org/software/S0534","kind":"malware","description":"[Bazar](https://attack.mitre.org/software/S0534) can attempt to overload sandbox analysis by sending 1550 calls to <code>printf</code>.(Citation: Cybereason Bazar July 2020)","relationship_id":"relationship--4d63c2b7-03e6-4747-81f2-9197faccd5fc","references":[{"source_name":"Cybereason Bazar July 2020","description":"Cybereason Nocturnus. (2020, July 16). A BAZAR OF TRICKS: FOLLOWING TEAM9’S DEVELOPMENT CYCLES. Retrieved November 18, 2020.","url":"https://www.cybereason.com/blog/a-bazar-of-tricks-following-team9s-development-cycles"}]},{"id":"S0554","name":"Egregor","url":"https://attack.mitre.org/software/S0554","kind":"malware","description":"[Egregor](https://attack.mitre.org/software/S0554) has used multiple anti-analysis and anti-sandbox techniques to prevent automated analysis by sandboxes.(Citation: Cyble Egregor Oct 2020)(Citation: NHS Digital Egregor Nov 2020) ","relationship_id":"relationship--89ef773b-6d5d-482e-9afd-bc892eb8093e","references":[{"source_name":"Cyble Egregor Oct 2020","description":"Cybleinc. (2020, October 31). Egregor Ransomware – A Deep Dive Into Its Activities and Techniques. Retrieved December 29, 2020.","url":"https://cybleinc.com/2020/10/31/egregor-ransomware-a-deep-dive-into-its-activities-and-techniques/"},{"source_name":"NHS Digital Egregor Nov 2020","description":"NHS Digital. (2020, November 26). Egregor Ransomware The RaaS successor to Maze. Retrieved December 29, 2020.","url":"https://digital.nhs.uk/cyber-alerts/2020/cc-3681#summary"}]},{"id":"S0666","name":"Gelsemium","url":"https://attack.mitre.org/software/S0666","kind":"malware","description":"[Gelsemium](https://attack.mitre.org/software/S0666) can use junk code to generate random activity to obscure malware behavior.(Citation: ESET Gelsemium June 2021)","relationship_id":"relationship--4f7680e9-3dd7-4365-a1cc-75342808e2c2","references":[{"source_name":"ESET Gelsemium June 2021","description":"Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.","url":"https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"}]},{"id":"S1020","name":"Kevin","url":"https://attack.mitre.org/software/S1020","kind":"malware","description":"[Kevin](https://attack.mitre.org/software/S1020) can sleep for a time interval between C2 communication attempts.(Citation: Kaspersky Lyceum October 2021)","relationship_id":"relationship--bb97930f-9c3a-4fac-84b1-8f954633aef0","references":[{"source_name":"Kaspersky Lyceum October 2021","description":"Kayal, A. et al. (2021, October). LYCEUM REBORN: COUNTERINTELLIGENCE IN THE MIDDLE EAST. Retrieved June 14, 2022.","url":"https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"}]},{"id":"S1030","name":"Squirrelwaffle","url":"https://attack.mitre.org/software/S1030","kind":"malware","description":"[Squirrelwaffle](https://attack.mitre.org/software/S1030) has contained a hardcoded list of IP addresses to block that belong to sandboxes and analysis platforms.(Citation: ZScaler Squirrelwaffle Sep 2021)(Citation: Netskope Squirrelwaffle Oct 2021)","relationship_id":"relationship--e9be6f26-bcc8-49b2-b1aa-e8ce664a1fcb","references":[{"source_name":"ZScaler Squirrelwaffle Sep 2021","description":"Kumar, A., Stone-Gross, Brett. (2021, September 28). Squirrelwaffle: New Loader Delivering Cobalt Strike. Retrieved August 9, 2022.","url":"https://www.zscaler.com/blogs/security-research/squirrelwaffle-new-loader-delivering-cobalt-strike"},{"source_name":"Netskope Squirrelwaffle Oct 2021","description":"Palazolo, G. (2021, October 7). SquirrelWaffle: New Malware Loader Delivering Cobalt Strike and QakBot. Retrieved August 9, 2022.","url":"https://www.netskope.com/blog/squirrelwaffle-new-malware-loader-delivering-cobalt-strike-and-qakbot"}]},{"id":"S1039","name":"Bumblebee","url":"https://attack.mitre.org/software/S1039","kind":"malware","description":"[Bumblebee](https://attack.mitre.org/software/S1039) has the ability to perform anti-virtualization checks.(Citation: Proofpoint Bumblebee April 2022)","relationship_id":"relationship--6515b62c-af1a-4b22-baca-0710ac898815","references":[{"source_name":"Proofpoint Bumblebee April 2022","description":"Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.","url":"https://www.proofpoint.com/us/blog/threat-insight/bumblebee-is-still-transforming"}]},{"id":"S1070","name":"Black Basta","url":"https://attack.mitre.org/software/S1070","kind":"malware","description":"[Black Basta](https://attack.mitre.org/software/S1070) can make a random number of calls to the `kernel32.beep` function to hinder log analysis.(Citation: Check Point Black Basta October 2022)","relationship_id":"relationship--2f5dca6b-3cd3-4b2a-b097-7eddd80bc366","references":[{"source_name":"Check Point Black Basta October 2022","description":"Check Point. (2022, October 20). BLACK BASTA AND THE UNNOTICED DELIVERY. Retrieved March 8, 2023.","url":"https://research.checkpoint.com/2022/black-basta-and-the-unnoticed-delivery/"}]},{"id":"S1130","name":"Raspberry Robin","url":"https://attack.mitre.org/software/S1130","kind":"malware","description":"[Raspberry Robin](https://attack.mitre.org/software/S1130) contains real and fake second-stage payloads following initial execution, with the real payload only delivered if the malware determines it is not running in a virtualized environment.(Citation: TrendMicro RaspberryRobin 2022)","relationship_id":"relationship--421b0dc2-fc78-4eb3-a336-ce8e4febccef","references":[{"source_name":"TrendMicro RaspberryRobin 2022","description":"Christopher So. (2022, December 20). Raspberry Robin Malware Targets Telecom, Governments. Retrieved May 17, 2024.","url":"https://www.trendmicro.com/en_us/research/22/l/raspberry-robin-malware-targets-telecom-governments.html"}]},{"id":"S1183","name":"StrelaStealer","url":"https://attack.mitre.org/software/S1183","kind":"malware","description":"[StrelaStealer](https://attack.mitre.org/software/S1183) payloads have used control flow obfuscation techniques such as excessively long code blocks of mathematical instructions to defeat sandboxing and related analysis methods.(Citation: PaloAlto StrelaStealer 2024)(Citation: Fortgale StrelaStealer 2023)","relationship_id":"relationship--6e2f668c-dfbd-482c-a5a7-c8ccfd378002","references":[{"source_name":"PaloAlto StrelaStealer 2024","description":"Benjamin Chang, Goutam Tripathy, Pranay Kumar Chhaparwal, Anmol Maurya & Vishwa Thothathri, Palo Alto Networks. (2024, March 22). Large-Scale StrelaStealer Campaign in Early 2024. Retrieved December 31, 2024.","url":"https://unit42.paloaltonetworks.com/strelastealer-campaign/"},{"source_name":"Fortgale StrelaStealer 2023","description":"Fortgale. (2023, September 18). StrelaStealer Malware Analysis. Retrieved December 31, 2024.","url":"https://fortgale.com/blog/malware-analysis/strelastealer-malware-analysis-2/"}]},{"id":"S1207","name":"XLoader","url":"https://attack.mitre.org/software/S1207","kind":"malware","description":"[XLoader](https://attack.mitre.org/software/S1207) can utilize decoy command and control domains within the malware configuration to circumvent sandbox analysis.(Citation: ANY.RUN XLoader 2023)(Citation: CheckPoint XLoader 2022)","relationship_id":"relationship--6ac4c8cc-c782-4749-9d22-7c5e70ff5ce0","references":[{"source_name":"CheckPoint XLoader 2022","description":"Alexey Bukhteyev & Raman Ladutska, Check Point Research. (2022, May 31). XLoader Botnet: Find Me If You Can. Retrieved March 11, 2025.","url":"https://research.checkpoint.com/2022/xloader-botnet-find-me-if-you-can/"},{"source_name":"ANY.RUN XLoader 2023","description":"ANY.RUN. (2023, February 28). XLoader/FormBook: Encryption Analysis and Malware Decryption . Retrieved March 11, 2025.","url":"https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/"}]},{"id":"S1240","name":"RedLine Stealer","url":"https://attack.mitre.org/software/S1240","kind":"malware","description":"[RedLine Stealer](https://attack.mitre.org/software/S1240) has an anti-sandbox technique that requires the malware to consistently check with the C2 server, if the communication fails [RedLine Stealer](https://attack.mitre.org/software/S1240) will not continue execution.(Citation: Splunk RedLine Stealer June 2023)","relationship_id":"relationship--c398b815-5ec1-45a9-bbe8-14153ae5d703","references":[{"source_name":"Splunk RedLine Stealer June 2023","description":"Splunk Threat Research Team. (2023, June 1). Do Not Cross The 'RedLine' Stealer: Detections and Analysis. Retrieved September 17, 2025.","url":"https://www.splunk.com/en_us/blog/security/do-not-cross-the-redline-stealer-detections-and-analysis.html"}]},{"id":"S9043","name":"Mini Shai-Hulud","url":"https://attack.mitre.org/software/S9043","kind":"malware","description":"[Mini Shai-Hulud](https://attack.mitre.org/software/S9043) has evaded sandbox detection by applying a 1-in-6 probability gate that generates a random number which will only trigger the wiper functionality when the set number outcome is met even in environments that match parameters of a geopolitical target.(Citation: Hunt.io TeamPCP Toolkit MAY 2026)","relationship_id":"relationship--fd10197b-dc82-46b8-b600-0abebdcaa8a5","references":[{"source_name":"Hunt.io TeamPCP Toolkit MAY 2026","description":"Hunt.io. (2026, May 14). How TeamPCP's Python Toolkit Survives a C2 Takedown: FIRESCALE, GitHub, and the Victim's Own Account. Retrieved July 16, 2026.","url":"https://hunt.io/blog/teampcp-python-toolkit-firescale-github-c2-takedown"}]}],"actors":[{"id":"G0012","name":"Darkhotel","url":"https://attack.mitre.org/groups/G0012","kind":"intrusion-set","description":"[Darkhotel](https://attack.mitre.org/groups/G0012) malware has employed just-in-time decryption of strings to evade sandbox detection.(Citation: Lastline DarkHotel Just In Time Decryption Nov 2015)","relationship_id":"relationship--7cc93842-6c19-4d5c-8e9b-81dfa58e859e","references":[{"source_name":"Lastline DarkHotel Just In Time Decryption Nov 2015","description":"Arunpreet Singh, Clemens Kolbitsch. (2015, November 5). Defeating Darkhotel Just-In-Time Decryption. Retrieved April 15, 2021.","url":"https://www.lastline.com/labsblog/defeating-darkhotel-just-in-time-decryption/"}]},{"id":"G1031","name":"Saint Bear","url":"https://attack.mitre.org/groups/G1031","kind":"intrusion-set","description":"[Saint Bear](https://attack.mitre.org/groups/G1031) contains several anti-analysis and anti-virtualization checks.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )","relationship_id":"relationship--1e42c88d-1513-445c-ae63-7d2a1840753f","references":[{"source_name":"Palo Alto Unit 42 OutSteel SaintBot February 2022 ","description":"Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.","url":"https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"}]},{"id":"G1052","name":"Contagious Interview","url":"https://attack.mitre.org/groups/G1052","kind":"intrusion-set","description":"[Contagious Interview](https://attack.mitre.org/groups/G1052) has requested victims to disable Docker and other container environments in attempts to thwart container isolation and ensure device infection.(Citation: Socket HexEval BeaverTail Contagious Interview June 2025)","relationship_id":"relationship--1ad68e81-78c0-4f9a-b824-8bc85218af44","references":[{"source_name":"Socket HexEval BeaverTail Contagious Interview June 2025","description":"Kirill Boychenko. (2025, June 25). Another Wave: North Korean Contagious Interview Campaign Drops 35 New Malicious npm Packages. Retrieved October 19, 2025.","url":"https://socket.dev/blog/north-korean-contagious-interview-campaign-drops-35-new-malicious-npm-packages"}]}],"mitigations":[],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1497":"/ttp-simulation/techniques/enterprise/T1497/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1497","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0016","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image_loaded":"C:\\Lab\\demo.dll","signed":false,"action":"load"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}}]}}