Registry Modification for Virtualization Sandbox Evasion
This rule monitors registry modifications for keys or values related to common virtualization platforms (VirtualBox, VMware, QEMU, Xen, Hyper-V). Such registry queries or modifications are often indicative of malware performing sandbox evasion to determine if the execution environment is a virtual machine or a sandbox used for analysis, allowing the malware to terminate or alter its behavior to avoid detection.
Microsoft Sentinel (KQL)
