OXLOADER Anti-Sandbox: mpr.dll WNetAddConnection2W with Malformed Resource
This rule detects suspicious activity indicative of virtualization or sandbox evasion. It looks for the loading of 'mpr.dll' in conjunction with specific registry keys related to VirtualBox ('HARDWARE\ACPI\DSDT\VBOX_'). Additionally, it identifies processes executing with command lines containing strings associated with Sandboxie ('sbiedll.dll'), network connection functions ('WNetAddConnection2W'), or queries for video controller information ('SELECT CurrentRefreshRate FROM Win32_VideoController'), which are often used by malware to detect analysis environments. The rule also correlates 'mpr.dll' and 'sbiedll.dll' loads within the same process.
Microsoft Sentinel (KQL)
