rule: meta: name: reference anti-VM strings targeting Qemu namespace: anti-analysis/anti-vm/vm-detection authors: - michael.hunhoff@mandiant.com scope: file att&ck: - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001] mbc: - Anti-Behavioral Analysis::Virtual Machine Detection [B0009] references: - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Qemu.cpp examples: - al-khaser_x86.exe_ features: - or: - string: /Qemu/i - string: /qemu-ga.exe/i - string: /BOCHS/i - string: /BXPC/i