Millenium RAT detect_sandbox anti-VM/anti-debug config flag reference
Detects the execution of processes containing the string 'detect_sandbox' in their command-line arguments. This pattern is commonly used by malicious code or automated tools attempting to determine if they are running within a virtualized or sandbox analysis environment.
Microsoft Sentinel (KQL)
