Registry, WMIC or service queries for known VM/sandbox artifacts

Siemphony@siemphonylowT1497unverified

AN0127 names two log sources, Sysmon EventID 1 (process creation) and EventID 7 (module load); this rule is built on the process-creation half only, so DLL-based sandbox-evasion checks that never spawn a process — the module-load half of the analytic — are outside what it can see. Three independent legs cover the discovery commands AN0127 describes: `reg.exe` reading the BIOS/ACPI registry keys a hypervisor leaves stubbed or renamed, `wmic.exe` reading hardware-identity fields (manufacturer, model, BIOS serial, board product, SMBIOS UUID) that virtualization platforms fill with recognisable vendor strings, and `sc.exe` querying the guest-integration service names VirtualBox and VMware register on a guest. Each leg pairs the binary with the argument text that makes it a hardware-identity read rather than routine service or registry administration; MITRE's `KnownVMArtifactList` knob only describes this category in the abstract ("registry paths, DLLs, services or device names indicative of sandbox/VM environments") — it names no specific value. All three value lists, including the VirtualBox/VMware service names in the third leg, are this rule's own choice of which artifacts to watch for, not MITRE's. The `TimeWindow` knob, for correlating a burst of discovery with a later payload drop, is unused: that needs a cross-event join lib/sigma does not model, so this rule flags each matching command in isolation and cannot distinguish one query from a script that runs all three in sequence. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0046, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath endswith "\\reg.exe" and (ProcessCommandLine contains "HARDWARE\\DESCRIPTION\\System\\BIOS" or ProcessCommandLine contains "HARDWARE\\ACPI\\DSDT" or ProcessCommandLine contains "SystemBiosVersion")) or (FolderPath endswith "\\wmic.exe" and (ProcessCommandLine contains "computersystem get manufacturer" or ProcessCommandLine contains "computersystem get model" or ProcessCommandLine contains "bios get serialnumber" or ProcessCommandLine contains "baseboard get product" or ProcessCommandLine contains "csproduct get uuid")) or (FolderPath endswith "\\sc.exe" and (ProcessCommandLine contains "VBoxService" or ProcessCommandLine contains "VBoxGuest" or ProcessCommandLine contains "VBoxSF" or ProcessCommandLine contains "VBoxMouse" or ProcessCommandLine contains "vmci" or ProcessCommandLine contains "vm3dmp" or ProcessCommandLine contains "vmmouse" or ProcessCommandLine contains "VMTools")))

Splunk · SPL

Run this as a search.

index=* ((Image="*\\reg.exe" AND (CommandLine="*HARDWARE\\DESCRIPTION\\System\\BIOS*" OR CommandLine="*HARDWARE\\ACPI\\DSDT*" OR CommandLine="*SystemBiosVersion*")) OR (Image="*\\wmic.exe" AND (CommandLine="*computersystem get manufacturer*" OR CommandLine="*computersystem get model*" OR CommandLine="*bios get serialnumber*" OR CommandLine="*baseboard get product*" OR CommandLine="*csproduct get uuid*")) OR (Image="*\\sc.exe" AND (CommandLine="*VBoxService*" OR CommandLine="*VBoxGuest*" OR CommandLine="*VBoxSF*" OR CommandLine="*VBoxMouse*" OR CommandLine="*vmci*" OR CommandLine="*vm3dmp*" OR CommandLine="*vmmouse*" OR CommandLine="*VMTools*")))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*\\\\reg.exe" AND (TO_LOWER(process.command_line) LIKE "*hardware\\\\description\\\\system\\\\bios*" OR TO_LOWER(process.command_line) LIKE "*hardware\\\\acpi\\\\dsdt*" OR TO_LOWER(process.command_line) LIKE "*systembiosversion*")) OR (TO_LOWER(process.executable) LIKE "*\\\\wmic.exe" AND (TO_LOWER(process.command_line) LIKE "*computersystem get manufacturer*" OR TO_LOWER(process.command_line) LIKE "*computersystem get model*" OR TO_LOWER(process.command_line) LIKE "*bios get serialnumber*" OR TO_LOWER(process.command_line) LIKE "*baseboard get product*" OR TO_LOWER(process.command_line) LIKE "*csproduct get uuid*")) OR (TO_LOWER(process.executable) LIKE "*\\\\sc.exe" AND (TO_LOWER(process.command_line) LIKE "*vboxservice*" OR TO_LOWER(process.command_line) LIKE "*vboxguest*" OR TO_LOWER(process.command_line) LIKE "*vboxsf*" OR TO_LOWER(process.command_line) LIKE "*vboxmouse*" OR TO_LOWER(process.command_line) LIKE "*vmci*" OR TO_LOWER(process.command_line) LIKE "*vm3dmp*" OR TO_LOWER(process.command_line) LIKE "*vmmouse*" OR TO_LOWER(process.command_line) LIKE "*vmtools*")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 3 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\reg\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)(HARDWARE\\DESCRIPTION\\System\\BIOS|HARDWARE\\ACPI\\DSDT|SystemBiosVersion)</field>    <description>Registry, WMIC or service queries for known VM/sandbox artifacts (1/3)</description>    <mitre>      <id>T1497</id>    </mitre>  </rule>   <rule id="100001" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\wmic\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)(computersystem get manufacturer|computersystem get model|bios get serialnumber|baseboard get product|csproduct get uuid)</field>    <description>Registry, WMIC or service queries for known VM/sandbox artifacts (2/3)</description>    <mitre>      <id>T1497</id>    </mitre>  </rule>   <rule id="100002" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\sc\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)(VBoxService|VBoxGuest|VBoxSF|VBoxMouse|vmci|vm3dmp|vmmouse|VMTools)</field>    <description>Registry, WMIC or service queries for known VM/sandbox artifacts (3/3)</description>    <mitre>      <id>T1497</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: low
Category: discovery_recon
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: f11d1f65-1be1-478b-85fd-2f75ca90073e

ATT&CKT1497

T1497Virtualization/Sandbox Evasion

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondiscovery recon

discovery reconAI draft — unreviewed

01 · What this rule detects

Command-line evidence that something on the host is asking "am I inside a VM or sandbox?" — the reconnaissance malware runs before deciding whether to detonate. The rule watches three specific ways of asking that question: reg.exe reading BIOS/ACPI registry keys, wmic.exe querying hardware identity fields, and sc.exe querying VM guest-integration service names. It does not detect virtualization evasion itself, only the discovery step that usually precedes it.

02 · Telemetry you need

Sysmon EventID 1 (process creation), with CommandLine logging enabled — the rule matches on argument text, not just the binary path. AN0127 also names EventID 7 (module load) for DLL-based checks that never spawn a process, but this rule does not use that half; a sandbox check performed entirely in-process via a loaded library is invisible here.

03 · How the logic works

Three independent selections, joined by 1 of selection* — any single one firing is enough: - selection_reg_bios: reg.exe with HARDWARE\DESCRIPTION\System\BIOS, HARDWARE\ACPI\DSDT, or SystemBiosVersion in the command line — keys a hypervisor typically leaves stubbed or renamed. - selection_wmic_hw: wmic.exe with computersystem get manufacturer, model, bios get serialnumber, baseboard get product, or csproduct get uuid — hardware-identity fields virtualization platforms fill with recognisable vendor strings. - selection_sc_vmdriver: sc.exe querying VBoxService, VBoxGuest, VBoxSF, VBoxMouse, vmci, vm3dmp, vmmouse, or VMTools — the guest-integration service names VirtualBox and VMware register on a guest. MITRE's KnownVMArtifactList knob only describes this category in the abstract ("registry paths, DLLs, services or device names indicative of sandbox/VM environments") — it names no literal value. All three value lists above, including the specific VBox/VMware service names, are this rule's own choice of what to watch for, not MITRE's. MITRE's TimeWindow knob — for correlating a burst of discovery with a later payload drop — is unused: that needs a cross-event join lib/sigma does not model, so each matching command is flagged in isolation, with no way to tell a single query apart from a script that runs all three in sequence.

04 · Common false positives

The dominant source is IT asset-inventory tooling: SCCM, Lansweeper, PDQ Inventory, and Intune hardware-attestation scripts routinely run the exact wmic/reg queries this rule matches, as part of scheduled hardware inventory sweeps. On a managed estate this will be the highest-volume match by a wide margin, which is why the rule sits at low rather than higher. Second, legitimate VirtualBox/VMware users — developers, QA engineers, administrators — will trigger selection_sc_vmdriver troubleshooting Guest Additions or VMware Tools on a machine that is a VM by design. Third, vendor update utilities (Dell Command | Update, HP Support Assistant) read the same BIOS registry key to decide which firmware package applies.
Note also that wmic.exe is deprecated and removed by default on Windows 11 24H2 and later unless reinstalled as an optional feature — coverage of the second leg narrows over time on modern estates, and that drift is not disclosed in the rule itself.

05 · Detection maturity

tier_1: This rule has never been run against real telemetry and sits at the lowest DeBMM maturity tier — authored, not validated. Treat every match as a lead to investigate, not a confirmed detection, until it has been tuned against a live inventory-tooling baseline.

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Exclude the process ancestry of known inventory agents (SCCM's ccmexec.exe, Lansweeper's scanning service) as a ParentImage filter. If VM guest tools are expected on specific hosts, suppress selection_sc_vmdriver by hostname or OU rather than dropping it globally. Consider splitting wmic and sc into separate rules with independent severities, since their false-positive profiles differ sharply from the reg.exe leg.

Declared by the author

IT asset-inventory and software-deployment tooling — SCCM, Lansweeper, PDQ Inventory, Intune hardware-attestation scripts — that routinely runs wmic and reg queries against BIOS, manufacturer and board fields as part of scheduled hardware inventory; this is the highest-volume match on a managed estate and is why the rule is not rated above low.
Legitimate use of VirtualBox or VMware on the endpoint itself: a developer, QA engineer or administrator running sc query against VBoxService, vmci or vm3dmp to troubleshoot Guest Additions or VMware Tools on a machine that is a VM guest or a VM host by design.
Driver and firmware update utilities that read SystemBiosVersion or the BIOS registry key to decide which update package applies, run from vendor tools like Dell Command | Update or HP Support Assistant.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1497, evaluated against their process_creation events.

Share this rule

/u/siemphony/f11d1f65-1be1-478b-85fd-2f75ca90073e

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Registry, WMIC or service queries for known VM/sandbox artifacts

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it