Home/ MITRE Matrix/ Defense Evasion/ T1497

T1497Virtualization/Sandbox Evasion

T1497 — Virtualization/Sandbox Evasion is a MITRE ATT&CK technique in the Defense Evasion tactic. Clankerusecase tracks 9 detection use cases covering it and 3 threat-intel articles citing it.

Defense EvasionDiscovery

View on the matrix → Filter Detection Library MITRE official spec ↗

9Use cases

3Articles

3Sub-techniques

2Tactics

Sub-techniques (3)

T1497.001 · System Checks T1497.003 · Time Based Checks T1497.002 · User Activity Based Checks

Use cases covering this technique (9)

Headless Browser Usage ESCU actions · hunting P Windows Chromium Browser Launched with Small Window Size ESCU actions · alerting P Windows Chromium Browser No Security Sandbox Process ESCU actions · alerting P Windows Chromium Browser with Custom User Data Directory ESCU actions · hunting P Windows Chromium process Launched with Disable Popup Blocking ESCU actions · hunting P Windows Chromium Process Launched with Logging Disabled ESCU actions · hunting P Windows Chromium Process with Disabled Extensions ESCU actions · hunting P [LLM] SleeperGem loader: ruby install script spawns shell running deploy.sh Bespoke install · alerting DSΣPDDCS [LLM] Scavenger Stealer sandbox-evasion marker file %TEMP%\SCVNGR_VM created Bespoke install · alerting DSΣPDDCS

Articles citing this technique (3)

high SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoor art-245

crit A rigged game: ScarCruft compromises gaming platform in a supply-chain attack art-500

crit Maintainers of ESLint Prettier Plugin Attacked via npm Supply Chain Malware art-917