macOS Malware VM/Sandbox Check via system_profiler + Self-Termination or CIS Kill-Switch
This rule detects potential malware sandbox/virtualization evasion behavior on macOS. It identifies processes that execute 'system_profiler' with hardware-identifying keywords (e.g., QEMU, VMware, KVM) and correlates this with either immediate process self-termination within 5 seconds or the presence of a 'cis_blocked' signal, which is indicative of a kill-switch mechanism often used by malicious actors to avoid analysis.
Cortex XDR
