(SIGMA) SIGMA_ANTI_VM
Created the . Updated 2 years, 3 months ago.
title: AntiVM
status: experimental
description: Detect virtual environment "VirtualBox|VMware|KVM|HVM"
author: Joe Security
date: 2019-11-06
id: 200020
threatname:
behaviorgroup: 5
classification: 8
mitreattack: T1497
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine:
- '*IlZpcnR1YWxCb3h8Vk13YXJlfEtWTXxIVk0i*'
condition: selection
level: critical
Associated Techniques
No associated technique found so far.