Kazuar - Anti-Analysis BIOS/CPU Querying (T1497.001)
Identifies Kazuar querying specific CPU or BIOS registry keys (VMware, VBox) to halt execution if it detects an analysis environment. This rule specifically looks for registry access to 'HARDWARE\DESCRIPTION\System\BIOS' combined with a process executing 'wmic bios get' on the command line.
Microsoft Sentinel (KQL)
