Virtual Machine Artifact Discovery via Registry Queries

Kaung Khant Ko@kaungkhantko

•updated Jun 25, 2026•0•0•2

Detects registry queries for common virtualization-related artifacts (e.g., VMware, VirtualBox) performed by specific suspicious processes. This behavior is indicative of sandbox or virtual machine evasion techniques used by malware to detect if it is running in an analysis environment before executing its malicious payload.