macOS VM/sandbox detection via is_vmware_mac() check
Detects the execution of macOS system utilities (system_profiler, ioreg) with specific arguments used to determine if the system is running inside a virtualized environment, specifically looking for VMware artifacts. This activity is commonly associated with reconnaissance by malware attempting to evade analysis or sandbox environments.
Microsoft Sentinel (KQL)
