However, VM software creates artifacts indicating that it is a virtual machine rather than a physical one. Virtual machine (VM) software is intended to emulate the functionality of physical hardware. These characteristics may be some properties or objects of the victim system (e.g., a specific MAC address of a VM vendor) and the absence of common artifacts created by regular users in the system (e.g., an empty browser history). In general, these methods involve searching for typical characteristics of these environments. Īdversaries use various methods to evade virtual machine and sandbox environments, which are referred to as " Anti-Sandbox" or " Anti-VM" methods. Agent Tesla remote access trojan (RAT) shuts down if it detects a sandbox environment as an example of malware sandbox evasion. Therefore, they design their code to detect virtual machine and sandbox environments and avoid exhibiting malicious behavior while running in these isolated environments. Of course, malware developers do not want their malware to be analyzed in isolated environments. TTPs and IOCs are used to detect the malware.
As a result of malware analysis, TTPs (Tactic, Technique, and Procedures) used by the malware and its IOCs (Indicators of Compromise) are identified. Similarly, security products often employ these environments to execute potentially malicious code for dynamic malware analysis before allowing it to enter the organization's network. Malware analysts frequently assess unknown code in isolated environments like virtual machines (VMs) or sandboxes. This blog explains the T1497 Virtualization/Sandbox Evasion technique of the MITRE ATT&CK® framework, the tenth technique in the Top 10 MITRE ATT&CK techniques list.ĭownload the Red Report - Top Ten MITRE ATT&CK Techniques Why Do Attackers Use the T1497 Virtualization/Sandbox Evasion Technique?
If the malware detects a virtual machine or sandbox environment, it disengages from the victim or does not perform malicious functions, such as downloading the additional payload. Virtualization/Sandbox Evasion is a technique utilized by adversaries as a part of their defense evasion strategy to detect and avoid virtualization and analysis environments, such as malware analysis sandboxes.
0 kommentar(er)
