T1497.001sub-technique of T1497 Virtualization/Sandbox Evasion

System Checks

Linux · macOS · Windowsnothing on this site yetT1497.001 on attack.mitre.org

Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant.
MITRE ATT&CK 19.2, retrieved 2026-09-12

how MITRE says to see it

Virtualization/Sandbox Evasion via System Checks across Windows, Linux, macOS

Script or binary performs a rapid sequence of system discovery checks (e.g., CPU count, RAM size, registry keys, running processes) indicative of VM detection
Shell script or binary uses multiple system commands (e.g., dmidecode, lscpu, lspci) in quick succession to detect virtualization environment
Bash, Swift, or Objective-C programs enumerate system profile, I/O registry, or inspect kernel extensions to identify VM artifacts

the rest of T1497

T1497.002 User Activity Based Checks · not covered yet
T1497.003 Time Based Checks · not covered yet

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.