mirror of
https://github.com/vee1e/capa-rules.git
synced 2026-09-01 10:58:40 +00:00
19 lines
541 B
YAML
19 lines
541 B
YAML
rule:
|
|
meta:
|
|
name: check for Windows sandbox via mutex
|
|
namespace: anti-analysis/anti-vm/vm-detection
|
|
authors:
|
|
- "@_re_fox"
|
|
scopes:
|
|
static: function
|
|
dynamic: span of calls
|
|
att&ck:
|
|
- Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]
|
|
mbc:
|
|
- Anti-Behavioral Analysis::Virtual Machine Detection [B0009]
|
|
references:
|
|
- https://github.com/LloydLabs/wsb-detect
|
|
features:
|
|
- and:
|
|
- match: check mutex on Windows
|
|
- string: "WindowsSandboxMutex"
|