attack.t1497.001

Powershell Detect Virtualization Environment

Apr 28, 2026 · attack.discovery attack.stealth attack.t1497.001 ·

Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox

System Information Discovery Using System_Profiler

Apr 28, 2026 · attack.discovery attack.stealth attack.t1082 attack.t1497.001 ·

Share on:

Detects the execution of "system_profiler" with specific "Data Types" that have been seen being used by threat actors and malware. It provides system hardware and software configuration information. This process is primarily used for system information discovery. However, "system_profiler" can also be used to determine if virtualization software is being run for defense evasion purposes.

System Information Discovery Via Sysctl - MacOS

Apr 28, 2026 · attack.stealth attack.t1497.001 attack.discovery attack.t1082 ·

Share on:

Detects the execution of "sysctl" with specific arguments that have been used by threat actors and malware. It provides system hardware information. This process is primarily used to detect and avoid virtualization and analysis environments.