Virtualization/Sandbox Evasion T1497
Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may…
- Tactics
- Stealth, Discovery
- Actors using it
- 10
- Sub-techniques
- 1
Ransomware groups reported using it
Threat actors
- KimsukyNorth Korea · Black Banshee, Velvet Chollima, Emerald Sleet · 87 techniques
- Volt TyphoonChina · BRONZE SILHOUETTE, Vanguard Panda, DEV-0391 · 58 techniques
- OilRigIran · COBALT GYPSY, IRN2, APT34 · 58 techniques
- Gamaredon GroupRussia · IRON TILDEN, Primitive Bear, ACTINIUM · 55 techniques
- FIN7GOLD NIAGARA, ITG14, Carbon Spider · 50 techniques
- Contagious InterviewDeceptiveDevelopment, Gwisin Gang, Tenacious Pungsan · 34 techniques
- DarkhotelSouth Korea · DUBNIUM, Zigzag Hail · 22 techniques
- WIRTEAshen Lepus · 21 techniques
- Saint BearRussia · Storm-0587, TA471, UAC-0056 · 13 techniques
- Evilnum11 techniques