T1497.001, System Checks, is the sub technique where malware inspects the host for signs of a virtual machine or sandbox. It applies to Linux, macOS and Windows and falls under stealth and discovery.
How attackers use it
Checks vary by adversary, but MITRE describes them using WMI, PowerShell, system information discovery and registry queries to gather system information and hunt for virtual machine artifacts. Artifacts may be in memory, processes, the file system, hardware or the registry. Adversaries may bundle checks into one script and have the program exit if it decides the host is virtual.
MITRE lists common things checked: host and domain names, samples of network traffic, network adapter addresses, CPU core count, memory and drive size, file and folder names that look like analysis artifacts such as malware or sample, VM specific services and installed programs, manufacturer strings, special I/O ports and VM specific processor instructions. Hardware checks, for fans, temperature sensors or audio devices, can also reveal a virtual host.
Examples include malware that checks Windows product IDs used by sandboxes along with usernames and disk serial numbers tied to analyst environments, a loader that exits when physical memory is under 1.5 GB, and a PowerShell check on the computer manufacturer.
How to detect it
MITRE's detection strategy has three analytics.
- Windows: a script or binary that runs a rapid series of discovery checks such as CPU count, RAM size, registry keys and running processes.
- Linux: a shell script or binary that runs several system commands in quick succession, such as dmidecode, lscpu and lspci.
- macOS: Bash, Swift or Objective-C programs that enumerate system profile data, I/O registry entries or kernel extensions.
MITRE names no log sources. Process creation with command lines, plus WMI and PowerShell script block logging where available, will show these checks.
On their own, each check is normal. The signal is many of them, together, from an unexpected process.
How to reduce the risk
MITRE says prevention is hard because the technique abuses normal system features. Make analysis environments harder to tell from real ones, and pair sandbox results with endpoint behavior monitoring.
Check your own environment
On a Linux analysis VM, these read-only commands show some of what malware would see.
lscpu | head -n 20
cat /sys/class/dmi/id/product_name
If the output says the product is a hypervisor, a basic check will find it. Consider adjusting what your sandbox reports.
Quick check
Name three values MITRE says are checked.
For example CPU core count, memory and drive size, MAC address, manufacturer strings and VM specific services.
