QuimaRAT Anti-VM Process Enumeration via tasklist
Detects the execution of 'tasklist.exe' with command line arguments that enumerate running processes associated with virtualization software, which is indicative of anti-VM behavior commonly observed in QuimaRAT malware. This detection identifies instances where 'tasklist.exe' is used to check for the presence of virtualization environments, which may suggest that the malware is attempting to evade analysis or detection in virtualized environments.
Sigma
