Techniques › T1497 › AN0128
AN0128 Analytic 0128
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Execution of commands to enumerate virtualization-related files or processes (e.g., '/sys/class/dmi/id/product_name', dmesg, lscpu, lspci), or querying hypervisor interfaces prior to malware execution.</p>
- Detects
- T1497 Virtualization/Sandbox Evasion
- Part of
- DET0046 Detection Strategy for T1497 Virtualization/Sandbox Evasion
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | execve or syscall invoking vm artifact check commands (e.g., dmidecode, lspci, dmesg) | DC0032 Process Creation |
| auditd:SYSCALL | sleep function usage or loops (nanosleep, usleep) in scripts | DC0064 Command Execution |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TimeWindow | Duration between VM discovery commands and payload execution |
CommandArtifactMatchList | Command-line regex patterns indicative of sandbox evasion (e.g., grep QEMU, strings vmware) |
KEV CVEs whose mapped technique this analytic detects
| CVE | Vendor / product | State |
|---|---|---|
| CVE-2014-0546 | Adobe Reader and Acrobat | Mapped |
| CVE-2015-3113 | Adobe Flash Player | Mapped |
| CVE-2025-2783 | Google Chromium Mojo | Mapped |
| CVE-2025-6558 | Google Chromium | Mapped |