DRAYN VM Detection via vmbusr.sys Check and GetUserDefaultLCID Locale Evasion

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•6

This rule detects the DRAYN malware performing environment reconnaissance and sandbox evasion. It monitors for file access to the 'vmbusr.sys' driver, which is commonly used to identify virtual machine environments, followed by the execution of PowerShell commands to retrieve the system's UUID via Win32_ComputerSystem, a technique used for host fingerprinting.