LIUSHEN Anti-VM Detection via Process Enumeration for Virtualization Tool Names

Subhankar H@Andrewsec57

•updated Jul 8, 2026•1•0•4

Detects processes attempting to enumerate or interact with virtualization-related software such as VirtualBox, VMware, XenServer, or QEMU. This behavior is a common anti-analysis technique used by malware to detect if it is executing within a virtualized sandbox or hypervisor environment.