Operation Turb00: Vidar/SnappyClient discovery & sandbox-evasion command burst

Ibrahim Saud@tektrix

•updated Jul 3, 2026•1•0•6

Detects anomalous system reconnaissance and potential anti-VM sandbox evasion behaviors exhibited by processes. The rule aggregates distinct indicators such as system information gathering (systeminfo, wmic), virtualization environment probing (VMware Tools detection), registry-based identity checks (MachineGuid, ComputerName), and broad enumeration of HKLM\SOFTWARE vendor keys, identifying processes that perform three or more of these distinct actions within a 5-minute window.