QuimaRAT Anti-VM Registry Query via reg.exe
Detects the execution of 'reg.exe' with command line arguments that query registry keys associated with virtualization software, which is indicative of anti-VM behavior commonly observed in QuimaRAT malware. This detection identifies instances where 'reg.exe' is used to check for the presence of virtualization environments, which may suggest that the malware is attempting to evade analysis or detection in virtualized environments.
Sigma
