Command line probes the host for hypervisor vendor artefacts

1title: Command line probes the host for hypervisor vendor artefacts2id: 24957830-c758-406c-86b2-138170f7af633status: experimental4description: |5  AN0478 describes a rapid sequence of system checks — CPU count, RAM size,6  registry keys, running processes — used to decide whether the host is a virtual7  machine or a sandbox. The sequence itself is not expressible: the analytic's8  TimeWindow knob asks for a burst of enumeration events inside X seconds, and9  lib/sigma has no aggregation, no timeframe and no near, so this rule fires on a10  single event and cannot tell one check from a run of ten. What it can do is11  separate VM detection from ordinary inventory, which is the whole difficulty12  with this technique: `Get-CimInstance Win32_ComputerSystem` and `wmic bios get13  serialnumber` are what every asset agent runs, and nothing in them is evasive.14  The discriminator used here is that the caller must *name a hypervisor vendor*15  in the command line — it is already looking for VMware, VirtualBox or QEMU16  rather than asking what the machine is — so the rule ANDs a list of enumeration17  binaries against a list of virtualization artefact strings covering the guest18  tools services, the vendor registry hives and the ACPI table names those tools19  register. Two things this deliberately cannot see, which matter more here than20  in most rules. Malware that performs the same checks in-process, through the21  WMI COM API, a CPUID instruction, a registry API call or a22  GetAdaptersInfo MAC-prefix comparison, creates no child process and produces23  nothing on this log source at all — process creation catches only the24  script-and-LOLBin form of the technique, which is the minority of it. And the25  brief's other two Windows legs do not help: Sysmon EventID 7 image_load and26  EventID 10 process_access carry no artefact name to match on for this27  behaviour. MITRE's ProcessAncestry and UserContext knobs are where a site adds28  a parent-process or session filter; the binary and artefact lists below were29  assembled here, not taken from MITRE.30  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0168, not hand-written and not tested by its author. Any lab result is on this rule's own page.31references:32  - https://attack.mitre.org/techniques/T1497/00133  - https://attack.mitre.org/detectionstrategies/DET016834author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)35date: 2026-08-1636tags:37  - attack.defense-evasion38  - attack.discovery39  - attack.t1497.00140logsource:41  category: process_creation42  product: windows43detection:44  selection_tool:45    Image|endswith:46      - '\wmic.exe'47      - '\reg.exe'48      - '\sc.exe'49      - '\tasklist.exe'50      - '\powershell.exe'51      - '\pwsh.exe'52      - '\cscript.exe'53      - '\wscript.exe'54  selection_artefact:55    CommandLine|contains:56      - 'VMware'57      - 'VirtualBox'58      - 'VBOX'59      - 'vboxservice'60      - 'vboxtray'61      - 'vmtoolsd'62      - 'vmwaretray'63      - 'vmwareuser'64      - 'QEMU'65      - 'Virtual Machine'66      - 'HARDWARE\ACPI\DSDT'67      - 'HARDWARE\ACPI\FADT'68      - 'HARDWARE\ACPI\RSDT'69      - 'SYSTEM\CurrentControlSet\Services\Disk\Enum'70      - 'SOFTWARE\Oracle\VirtualBox'71  condition: selection_tool and selection_artefact72falsepositives:73  - "Guest-tools installers and updaters. VMware Tools, the VirtualBox Guest Additions and the equivalent QEMU guest agent all probe for their own service and registry keys with sc query, reg query and WMI during install, upgrade and repair, and their names sit in the artefact list by construction. On a virtualized estate this is the single largest source of matches."74  - "Software inventory and configuration management. Detection methods in Configuration Manager applications, Intune requirement scripts, and Ansible or Puppet facts that test for VMware Tools before applying a policy re-evaluate on a fixed schedule, so the same command line recurs on every managed guest at every cycle rather than once."75  - "Monitoring and backup agents that check guest-tools health. Hypervisor-aware backup products and NOC checks query the VMTools service state to decide whether quiesced snapshots are possible, which matches sc.exe against the VMware term on every polling interval."76  - "Virtualization administrators and support staff troubleshooting by hand. Confirming whether a machine is a guest, or why guest tools are not reporting, is done with exactly these commands, and on a helpdesk it happens often enough to outnumber anything malicious."77level: medium