SilverFox Loader Anti-Sandbox/VM Evasion Checks from Trojanized OEM Processes
Detects the SilverFox loader performing sandbox and virtual machine evasion checks, including process enumeration (CreateToolhelp32Snapshot), heap pressure via VirtualAllocExNuma, and timing checks (QueryPerformanceCounter, NtAllocateVirtualMemoryApiCall). The detection focuses on specific process names and file paths associated with trojanized Panasonic/Philips OEM process contexts.
Microsoft Sentinel (KQL)
