Command line probes the host for hypervisor vendor artefacts

Siemphony@siemphonymediumT1497.001unverified

AN0478 describes a rapid sequence of system checks — CPU count, RAM size, registry keys, running processes — used to decide whether the host is a virtual machine or a sandbox. The sequence itself is not expressible: the analytic's TimeWindow knob asks for a burst of enumeration events inside X seconds, and lib/sigma has no aggregation, no timeframe and no near, so this rule fires on a single event and cannot tell one check from a run of ten. What it can do is separate VM detection from ordinary inventory, which is the whole difficulty with this technique: `Get-CimInstance Win32_ComputerSystem` and `wmic bios get serialnumber` are what every asset agent runs, and nothing in them is evasive. The discriminator used here is that the caller must *name a hypervisor vendor* in the command line — it is already looking for VMware, VirtualBox or QEMU rather than asking what the machine is — so the rule ANDs a list of enumeration binaries against a list of virtualization artefact strings covering the guest tools services, the vendor registry hives and the ACPI table names those tools register. Two things this deliberately cannot see, which matter more here than in most rules. Malware that performs the same checks in-process, through the WMI COM API, a CPUID instruction, a registry API call or a GetAdaptersInfo MAC-prefix comparison, creates no child process and produces nothing on this log source at all — process creation catches only the script-and-LOLBin form of the technique, which is the minority of it. And the brief's other two Windows legs do not help: Sysmon EventID 7 image_load and EventID 10 process_access carry no artefact name to match on for this behaviour. MITRE's ProcessAncestry and UserContext knobs are where a site adds a parent-process or session filter; the binary and artefact lists below were assembled here, not taken from MITRE. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0168, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath endswith "\\wmic.exe" or FolderPath endswith "\\reg.exe" or FolderPath endswith "\\sc.exe" or FolderPath endswith "\\tasklist.exe" or FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe" or FolderPath endswith "\\cscript.exe" or FolderPath endswith "\\wscript.exe") and (ProcessCommandLine contains "VMware" or ProcessCommandLine contains "VirtualBox" or ProcessCommandLine contains "VBOX" or ProcessCommandLine contains "vboxservice" or ProcessCommandLine contains "vboxtray" or ProcessCommandLine contains "vmtoolsd" or ProcessCommandLine contains "vmwaretray" or ProcessCommandLine contains "vmwareuser" or ProcessCommandLine contains "QEMU" or ProcessCommandLine contains "Virtual Machine" or ProcessCommandLine contains "HARDWARE\\ACPI\\DSDT" or ProcessCommandLine contains "HARDWARE\\ACPI\\FADT" or ProcessCommandLine contains "HARDWARE\\ACPI\\RSDT" or ProcessCommandLine contains "SYSTEM\\CurrentControlSet\\Services\\Disk\\Enum" or ProcessCommandLine contains "SOFTWARE\\Oracle\\VirtualBox"))

Splunk · SPL

Run this as a search.

index=* ((Image="*\\wmic.exe" OR Image="*\\reg.exe" OR Image="*\\sc.exe" OR Image="*\\tasklist.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\cscript.exe" OR Image="*\\wscript.exe") AND (CommandLine="*VMware*" OR CommandLine="*VirtualBox*" OR CommandLine="*VBOX*" OR CommandLine="*vboxservice*" OR CommandLine="*vboxtray*" OR CommandLine="*vmtoolsd*" OR CommandLine="*vmwaretray*" OR CommandLine="*vmwareuser*" OR CommandLine="*QEMU*" OR CommandLine="*Virtual Machine*" OR CommandLine="*HARDWARE\\ACPI\\DSDT*" OR CommandLine="*HARDWARE\\ACPI\\FADT*" OR CommandLine="*HARDWARE\\ACPI\\RSDT*" OR CommandLine="*SYSTEM\\CurrentControlSet\\Services\\Disk\\Enum*" OR CommandLine="*SOFTWARE\\Oracle\\VirtualBox*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*\\\\wmic.exe" OR TO_LOWER(process.executable) LIKE "*\\\\reg.exe" OR TO_LOWER(process.executable) LIKE "*\\\\sc.exe" OR TO_LOWER(process.executable) LIKE "*\\\\tasklist.exe" OR TO_LOWER(process.executable) LIKE "*\\\\powershell.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pwsh.exe" OR TO_LOWER(process.executable) LIKE "*\\\\cscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\wscript.exe") AND (TO_LOWER(process.command_line) LIKE "*vmware*" OR TO_LOWER(process.command_line) LIKE "*virtualbox*" OR TO_LOWER(process.command_line) LIKE "*vbox*" OR TO_LOWER(process.command_line) LIKE "*vboxservice*" OR TO_LOWER(process.command_line) LIKE "*vboxtray*" OR TO_LOWER(process.command_line) LIKE "*vmtoolsd*" OR TO_LOWER(process.command_line) LIKE "*vmwaretray*" OR TO_LOWER(process.command_line) LIKE "*vmwareuser*" OR TO_LOWER(process.command_line) LIKE "*qemu*" OR TO_LOWER(process.command_line) LIKE "*virtual machine*" OR TO_LOWER(process.command_line) LIKE "*hardware\\\\acpi\\\\dsdt*" OR TO_LOWER(process.command_line) LIKE "*hardware\\\\acpi\\\\fadt*" OR TO_LOWER(process.command_line) LIKE "*hardware\\\\acpi\\\\rsdt*" OR TO_LOWER(process.command_line) LIKE "*system\\\\currentcontrolset\\\\services\\\\disk\\\\enum*" OR TO_LOWER(process.command_line) LIKE "*software\\\\oracle\\\\virtualbox*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\wmic\.exe$|\\reg\.exe$|\\sc\.exe$|\\tasklist\.exe$|\\powershell\.exe$|\\pwsh\.exe$|\\cscript\.exe$|\\wscript\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i)(VMware|VirtualBox|VBOX|vboxservice|vboxtray|vmtoolsd|vmwaretray|vmwareuser|QEMU|Virtual Machine|HARDWARE\\ACPI\\DSDT|HARDWARE\\ACPI\\FADT|HARDWARE\\ACPI\\RSDT|SYSTEM\\CurrentControlSet\\Services\\Disk\\Enum|SOFTWARE\\Oracle\\VirtualBox)</field>    <description>Command line probes the host for hypervisor vendor artefacts</description>    <mitre>      <id>T1497.001</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: discovery_recon
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 24957830-c758-406c-86b2-138170f7af63

ATT&CKT1497.001

T1497.001System Checks

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondiscovery recon

discovery reconAI draft — unreviewed

01 · What this rule detects

02 · Telemetry you need

process_creation / windows, one of AN0478's three log sources. Sysmon EventID 1 gives Image and CommandLine directly; on Security EventID 4688 you need Audit Process Creation plus the separate Include command line in process creation events policy, or the artefact selection never matches and the rule is silently blind. The brief's other two Windows legs — image_load and process_access — were not used: neither carries an artefact name to match on for this behaviour.

03 · How the logic works

selection_tool is an Image|endswith list of enumeration binaries: wmic.exe, reg.exe, sc.exe, tasklist.exe, powershell.exe, pwsh.exe, cscript.exe, wscript.exe. selection_artefact is fifteen CommandLine|contains terms — vendor names (VMware, VirtualBox, VBOX, QEMU), guest-tool process names (vmtoolsd, vboxservice, vboxtray, vmwaretray, vmwareuser), and registry paths (SOFTWARE\Oracle\VirtualBox, HARDWARE\ACPI\DSDT/FADT/RSDT, SYSTEM\CurrentControlSet\Services\Disk\Enum). The discriminator is that the caller already names a hypervisor, or reads one of the keys whose values expose one — it is not asking what the machine is, it is checking whether it is a VM. Both lists are the pipeline's own; MITRE contributes only the ProcessAncestry and UserContext knobs. Two coverage dents worth knowing. The idiomatic process check is tasklist | findstr vmtoolsd; tasklist.exe's own command line carries no artefact string and findstr.exe/find.exe are not in the tool list, so only the rarer tasklist /FI "IMAGENAME eq vmtoolsd.exe" form matches. Likewise cscript/wscript fire only when the artefact is a command-line argument — a .vbs holding VMware in its body produces a command line of just the script path. And the whole class of in-process checks (CPUID, the WMI COM API, a registry API call, a MAC-prefix comparison) spawns no child process and leaves nothing on this source at all.

04 · Common false positives

Almost entirely scheduled automation on a virtualized estate. Guest-tools installers, updaters and repair runs probe for their own services and keys and are the single largest source of matches. Configuration Manager detection methods, Intune requirement scripts and Ansible/Puppet facts re-evaluate on every managed guest at every cycle. Hypervisor-aware backup products query the VMTools service state on every polling interval. The false-positive block misses one: Virtual Machine is a bare term, and the Hyper-V service is named Hyper-V Virtual Machine Management, so sc.exe query against it matches on any Windows 11 host with Hyper-V, WSL2 or Sandbox enabled — the developer fleet.

05 · Detection maturity

tier_1: , the lowest tier, and it stays there until the rule has been run against real data — it has never been executed against a log line.
tier_2: is the exclusions above plus a level re-derived from what survives them.
tier_3: is the burst correlation AN0478 actually describes, which needs an engine with aggregation, not Sigma as modelled here.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Exclude the config-management, backup and monitoring service accounts and the guest-tools deployment window before anything else; that removes three of the four listed sources. Drop or qualify the Virtual Machine term — the vendor-specific strings already carry the discriminating signal. MITRE's ProcessAncestry knob is where the real precision lives: the same command line from winword.exe or a browser child is a different event from the same one under an SCCM agent. The rule ships medium; review judged that unsupported against its own false positives, and low is defensible until the service-account exclusions exist.

Declared by the author

Guest-tools installers and updaters. VMware Tools, the VirtualBox Guest Additions and the equivalent QEMU guest agent all probe for their own service and registry keys with sc query, reg query and WMI during install, upgrade and repair, and their names sit in the artefact list by construction. On a virtualized estate this is the single largest source of matches.
Software inventory and configuration management. Detection methods in Configuration Manager applications, Intune requirement scripts, and Ansible or Puppet facts that test for VMware Tools before applying a policy re-evaluate on a fixed schedule, so the same command line recurs on every managed guest at every cycle rather than once.
Monitoring and backup agents that check guest-tools health. Hypervisor-aware backup products and NOC checks query the VMTools service state to decide whether quiesced snapshots are possible, which matches sc.exe against the VMware term on every polling interval.
Virtualization administrators and support staff troubleshooting by hand. Confirming whether a machine is a guest, or why guest tools are not reporting, is done with exactly these commands, and on a helpdesk it happens often enough to outnumber anything malicious.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1497.001, evaluated against their process_creation events.

Share this rule

/u/siemphony/24957830-c758-406c-86b2-138170f7af63

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Command line probes the host for hypervisor vendor artefacts

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it