Sandbox/VM Fingerprinting via Registry & File Artifact Checks (T1497)

Ibrahim Saud@tektrix

•updated 9 days ago•1•0•1

Detects processes querying registry keys or accessing file paths associated with common virtualization and sandbox environments (e.g., VMware, VirtualBox, Hyper-V, Sandboxie). This behavior is often indicative of malware attempting to identify if it is running in an analysis or sandbox environment to evade detection.