T1497: Virtualization/Sandbox Evasion
Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from Virtualization/Sandbox Evasion during automated discovery to shape follow-on behaviors.[1]
Adversaries may use several methods to accomplish Virtualization/Sandbox Evasion such as checking for security monitoring tools (e.g., Sysinternals, Wireshark, etc.) or other system artifacts associated with analysis or virtualization. Adversaries may also check for legitimate user activity to help determine if it is in an analysis environment. Additional methods include use of sleep timers or loops within malware code to avoid operating within a temporary sandbox.[2]
Analyst context for executives and security teams
Virtualization/Sandbox Evasion matters because it can cause malware to behave differently when it thinks it is being analyzed. For leaders, the practical risk is that automated detonation, malware triage, and some managed detection workflows may understate what a payload can do if the sample detects a virtual machine, sandbox, monitoring tool, short runtime window, or lack of normal user activity.
Executive priority
Treat this as an assurance and readiness issue, not only a malware feature. Ask whether security teams can validate suspicious files and implants across Linux, macOS, and Windows without relying on a single sandbox result. This technique is relevant to incident decision-making because a “no behavior observed” sandbox verdict may be inconclusive. It also supports audit and resilience discussions around whether detection engineering, incident response, and threat intelligence processes account for evasive malware behavior.
Technical view
ATT&CK places T1497 under stealth and discovery for Linux, macOS, and Windows. The supplied relationships show sub-techniques for System Checks and Time Based Checks, so defenders should validate both environment-artifact discovery and delayed or timing-aware execution. SOC and IR teams should correlate sandbox findings with endpoint telemetry from real or representative hosts, especially when samples inspect monitoring tools, virtualization artifacts, uptime, clocks, sleep timers, or signs of real user activity. The related DET0046 detection strategy indicates there is ATT&CK detection-strategy context for this object, but the official technique field supplied here does not include specific detection text.
Likely telemetry
- Endpoint process creation and command-line activity on Linux, macOS, and Windows
- API or system-call level evidence related to system, clock, uptime, and environment queries where available
- File, registry, device, driver, service, or system artifact access that may indicate checks for virtualization or analysis environments
- Security tool or monitoring tool enumeration activity, including references to tools such as Sysinternals or Wireshark when visible
- Sandbox detonation logs, including execution duration, sleep behavior, dropped payload timing, and differences across analysis profiles
Detection direction
- Do not treat a clean or low-activity sandbox run as decisive when the sample shows long sleeps, environment checks, or analysis-tool awareness.
- Compare behavior across sandbox, VM, and representative endpoint environments to identify payloads that disengage or withhold secondary stages.
- Tune analytics around discovery of virtualization artifacts, security tools, uptime, system time, and clock manipulation indicators, while accounting for legitimate admin, QA, research, and IT troubleshooting activity.
- Use relationship context from T1497.001 System Checks and T1497.003 Time Based Checks to split detection validation into environment-inspection behavior and delayed/timing behavior.
- Review DET0046 as the ATT&CK-linked detection strategy for this technique, but confirm local telemetry and rule logic before claiming coverage.
Mitigation priorities
- Prioritize resilient analysis workflows: combine sandboxing with endpoint telemetry, manual IR review, and repeat detonation under varied runtime and environment conditions.
- Harden SOC procedures so evasive or inconclusive malware analysis results trigger escalation criteria rather than closure.
- Ensure EDR, logging, and malware-analysis tooling retain enough process, file, system query, and timing evidence to reconstruct evasion behavior.
- Maintain representative analysis environments where practical, while recognizing that adversaries may still detect artifacts or lack of normal user activity.
- Use findings from evasive samples to improve detection engineering and incident response playbooks across supported platforms rather than relying on one control layer.
Analyst notes and limits
The object is broadly applicable across Linux, macOS, and Windows and has many relationships to campaigns, groups, and malware/software, including loaders, backdoors, banking malware, spyware, ransomware, and wipers. That breadth makes the technique useful for defensive coverage planning, but the relationships should not be read as current activity or exposure without local intelligence.
The supplied ATT&CK object does not provide official detection guidance, and relationship descriptions are partial. This take is limited to the official fields, external references, and listed relationships. Local telemetry, tooling, sandbox configuration, and incident context are required to determine actual coverage or risk.
Virtualization/Sandbox Evasion
Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from Virtualization/Sandbox Evasion during automated discovery to shape follow-on behaviors.[1]
Adversaries may use several methods to accomplish Virtualization/Sandbox Evasion such as checking for security monitoring tools (e.g., Sysinternals, Wireshark, etc.) or other system artifacts associated with analysis or virtualization. Adversaries may also check for legitimate user activity to help determine if it is in an analysis environment. Additional methods include use of sleep timers or loops within malware code to avoid operating within a temporary sandbox.[2]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1497.002 | User Activity Based Checks Sub-technique | User Activity Based Checks subtechnique of this object. |
| Enterprise | T1497.001 | System Checks Sub-technique | System Checks subtechnique of this object. |
| Enterprise | T1497.003 | Time Based Checks Sub-technique | Time Based Checks subtechnique of this object. |
Groups, software, and campaigns
G1052: Contagious Interview
Contagious Interview is a North Korea–aligned threat group active since 2023. The group conducts both cyberespionage and financially motivated operations, including the theft of cryptocurrency and user credentials. Contagious Interview targets Windows, Linux, and macOS systems, with a particular focus on individuals engaged in software development and cryptocurrency-related activities. [1][2][3][4][5][6][7][8]
G1031: Saint Bear
Saint Bear is a Russian-nexus threat actor active since early 2021, primarily targeting entities in Ukraine and Georgia. The group is notable for a specific remote access tool, Saint Bot, and information stealer, OutSteel in campaigns. Saint Bear typically relies on phishing or web staging of malicious documents and related file types for initial access, spoofing government or related entities.[1][2] Saint Bear has previously been confused with Ember Bear operations, but analysis of behaviors, tools, and targeting indicates these are distinct clusters.
G0012: Darkhotel
Darkhotel is a suspected South Korean threat group that has targeted victims primarily in East Asia since at least 2004. The group's name is based on cyber espionage operations conducted via hotel Internet networks against traveling executives and other select guests. Darkhotel has also conducted spearphishing campaigns and infected victims through peer-to-peer and file sharing networks.[1][2][3]
S0380: StoneDrill
StoneDrill is wiper malware discovered in destructive campaigns against both Middle Eastern and European targets in association with APT33.[1][2]
S0483: IcedID
S0331: Agent Tesla
Agent Tesla is a spyware Trojan written for the .NET framework that has been observed since at least 2014.[1][2][3]
S0268: Bisonal
Bisonal is a remote access tool (RAT) that has been used by Tonto Team against public and private sector organizations in Russia, South Korea, and Japan since at least December 2010.[1][2]
S0484: Carberp
S1070: Black Basta
Black Basta is ransomware written in C++ that has been offered within the ransomware-as-a-service (RaaS) model since at least April 2022; there are variants that target Windows and VMWare ESXi servers. Black Basta operations have included the double extortion technique where in addition to demanding ransom for decrypting the files of targeted organizations the cyber actors also threaten to post sensitive information to a leak site if the ransom is not paid. Black Basta affiliates have targeted multiple high-value organizations, with the largest number of victims based in the U.S. Based on similarities in TTPs, leak sites, payment sites, and negotiation tactics, security researchers assess the Black Basta RaaS operators could include current or former members of the Conti group.[1][2][3][4][5][6]
S1130: Raspberry Robin
Raspberry Robin is initial access malware first identified in September 2021, and active through early 2024. The malware is notable for spreading via infected USB devices containing a malicious LNK object that, on execution, retrieves remote hosted payloads for installation. Raspberry Robin has been widely used against various industries and geographies, and as a precursor to information stealer, ransomware, and other payloads such as SocGholish, Cobalt Strike, IcedID, and Bumblebee.[1][2][3] The DLL componenet in the Raspberry Robin infection chain is also referred to as "Roshtyak."[4] The name "Raspberry Robin" is used to refer to both the malware as well as the threat actor associated with its use, although the Raspberry Robin operators are also tracked as Storm-0856 by some vendors.[5]
S0534: Bazar
Bazar is a downloader and backdoor that has been used since at least April 2020, with infections primarily against professional services, healthcare, manufacturing, IT, logistics and travel companies across the US and Europe. Bazar reportedly has ties to TrickBot campaigns and can be used to deploy additional malware, including ransomware, and to steal sensitive data.[1]
S0666: Gelsemium
S0023: CHOPSTICK
CHOPSTICK is a malware family of modular backdoors used by APT28. It has been used since at least 2012 and is usually dropped on victims as second-stage malware, though it has been used as first-stage malware in several cases. It has both Windows and Linux variants. [1] [2] [3] [4] It is tracked separately from the X-Agent for Android.
S0455: Metamorfo
S1039: Bumblebee
Bumblebee is a custom loader written in C++ that has been used by multiple threat actors, including possible initial access brokers, to download and execute additional payloads since at least March 2022. Bumblebee has been linked to ransomware operations including Conti, Quantum, and Mountlocker and derived its name from the appearance of "bumblebee" in the user-agent.[1][2][3]
C0005: Operation Spalax
Operation Spalax was a campaign that primarily targeted Colombian government organizations and private companies, particularly those associated with the energy and metallurgical industries. The Operation Spalax threat actors distributed commodity malware and tools using generic phishing topics related to COVID-19, banking, and law enforcement action. Security researchers noted indicators of compromise and some infrastructure overlaps with other campaigns dating back to April 2018, including at least one separately attributed to APT-C-36, however identified enough differences to report this as separate, unattributed activity.[1]
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 2.0 | Current bundle | eac26eb9c8d2… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
Deloitte Environment Awareness
Torello, A. & Guibernau, F. (n.d.). Environment Awareness. Retrieved September 13, 2024.
Open source URL -
[2]
Unit 42 Pirpi July 2015
Falcone, R., Wartell, R.. (2015, July 27). UPS: Observations on CVE-2015-3113, Prior Zero-Days and the Pirpi Payload. Retrieved April 23, 2019.
Open source URL -
[3]
mitre-attack T1497Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.