Home/ MITRE Matrix/ Defense Evasion/ T1497

T1497Virtualization/Sandbox Evasion

T1497 — Virtualization/Sandbox Evasion is a MITRE ATT&CK technique in the Defense Evasion tactic. Clankerusecase tracks 10 detection use cases covering it and 4 threat-intel articles citing it.

Defense EvasionDiscovery

View on the matrix → Filter Detection Library MITRE official spec ↗

10Use cases

4Articles

3Sub-techniques

2Tactics

Sub-techniques (3)

T1497.001 · System Checks T1497.003 · Time Based Checks T1497.002 · User Activity Based Checks

Use cases covering this technique (10)

Headless Browser Usage ESCU actions · hunting P Windows Chromium Browser Launched with Small Window Size ESCU actions · alerting P Windows Chromium Browser No Security Sandbox Process ESCU actions · alerting P Windows Chromium Browser with Custom User Data Directory ESCU actions · hunting P Windows Chromium process Launched with Disable Popup Blocking ESCU actions · hunting P Windows Chromium Process Launched with Logging Disabled ESCU actions · hunting P Windows Chromium Process with Disabled Extensions ESCU actions · hunting P [LLM] TELESHIM DLL side-load: RegSchdTask.exe loads rogue AsTaskSched.dll Bespoke install · hunting DSΣPDD [LLM] SleeperGem loader: ruby install script spawns shell running deploy.sh Bespoke install · alerting DSΣPDDCS [LLM] Scavenger Stealer sandbox-evasion marker file %TEMP%\SCVNGR_VM created Bespoke install · alerting DSΣPDDCS

Articles citing this technique (4)

crit TELESHIM Abuses Telegram for C2 in Attacks Against Middle East Governments art-66

high SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoor art-140

crit A rigged game: ScarCruft compromises gaming platform in a supply-chain attack art-455

crit Maintainers of ESLint Prettier Plugin Attacked via npm Supply Chain Malware art-894