Elastic Defend high stable eql
Potential Virtual Machine Fingerprinting via VMDetect
Identifies the use of VMdetect utility to avoid execution on Malware sandboxes and virtual machines. An adversary may attempt to get detailed information about the operating system and hardware.
Detection Logic
process where event.action == "start" and process.pe.original_file_name == "vmdetect.exe"Field Validations
Loading…
Comments (0)
Loading comments...