BQTLock/BQT.exe Sandbox and VM Environment Detection Checks
Detects BQT.exe or start.exe performing activities indicative of sandbox or virtual machine environment evasion. This includes querying registry keys related to virtualization artifacts, spawning system information tools like wmic.exe, systeminfo.exe, or reg.exe, and enumerating processes associated with virtualization software like vmtoolsd.exe, vboxservice.exe, or vboxtray.exe.
Cortex XDR
