ATT&CK technique
View on MITRE ATT&CK →
T1497
Virtualization/Sandbox Evasion
StealthDiscovery
12 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Virtual Machine Fingerprinting | production | 2026-10-09 |
| elastic | Suspicious SIP Check by macOS Application | production | 2026-09-18 |
| elastic | Potential Microsoft Office Sandbox Evasion | production | 2026-09-18 |
| elastic | Virtual Machine Fingerprinting via Grep | production | 2026-09-18 |
| elastic | Delayed Execution via Ping | production | 2026-09-18 |
| splunk | Headless Browser Usage | production | 2026-06-25 |
| splunk | Windows Chromium Browser No Security Sandbox Process | production | 2026-06-25 |
| splunk | Windows Chromium Browser with Custom User Data Directory | production | 2026-06-25 |
| splunk | Windows Chromium Process with Disabled Extensions | production | 2026-05-13 |
| splunk | Windows Chromium Process Launched with Logging Disabled | production | 2026-05-13 |
| splunk | Windows Chromium process Launched with Disable Popup Blocking | production | 2026-05-13 |
| splunk | Windows Chromium Browser Launched with Small Window Size | production | 2026-05-13 |