Sandbox Detection Query - VirtualBox Check

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•3

This Suricata rule detects HTTP requests containing 'VBoxService' in the URI. This string is associated with VirtualBox Guest Additions, which are often installed in virtualized environments. The presence of such a string in network traffic can indicate that a system is a virtual machine, which attackers or malware might query to detect if they are running in a sandbox or virtualized analysis environment. This detection is categorized as 'trojan-activity' and is related to discovery tactics.