/
check-for-sandbox-username-or-hostname.yml
77 lines (77 loc) · 2.8 KB
/
check-for-sandbox-username-or-hostname.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
rule:
meta:
name: check for sandbox username or hostname
namespace: anti-analysis/anti-vm/vm-detection
authors:
- "@_re_fox"
- "echernofsky@google.com"
scopes:
static: function
dynamic: thread
att&ck:
- Defense Evasion::Virtualization/Sandbox Evasion [T1497]
mbc:
- Anti-Behavioral Analysis::Virtual Machine Detection [B0009]
references:
- https://github.com/LloydLabs/wsb-detect
examples:
- ccbf7cba35bab56563c0fbe4237fdc41:0x402B90
features:
- and:
- or:
- match: get session user name
# Usernames often overlap with hostnames for many of these checks.
- match: get hostname
- or:
- string: /MALTEST/i
description: Betabot Username Check
- string: /TEQUILABOOMBOOM/i
description: VirusTotal Sandbox
- string: /SANDBOX/i
description: Gookit Username Check
- string: /^VIRUS/i
description: Satan Username Check
- string: /MALWARE/i
description: Betabot Username Check
- string: /SAND\s?BOX/i
description: Betabot Username Check
- string: /Test\sUser/i
description: Betabot Username Check
- string: /CurrentUser/i
description: Gookit Username Check
- string: /7SILVIA/i
description: Gookit Username Check
- string: /FORTINET/i
description: Shifu Username Check
- string: /John\s?Doe/i
description: Emotet Username Check
- string: /Emily/i
description: Trickbot Downloader Username Check
- string: /HANSPETER(-PC)?/i
description: Trickbot Downloader Username Check
- string: /HAPUBWS/i
description: Trickbot Downloader Username Check
- string: /Hong\sLee/i
description: Trickbot Downloader Username Check
- string: /IT-ADMIN/i
description: Trickbot Downloader Username Check
- string: /JOHN(-PC)?/i
description: Trickbot Downloader Username Check
- string: /Johnson/i
description: Trickbot Downloader Username Check
- string: /Miller/i
description: Trickbot Downloader Username Check
- string: /MUELLER(-PC)?/i
description: Trickbot Downloader Username Check
- string: /Peter\sWilson/i
description: Trickbot Downloader Username Check
- string: /SystemIT/i
description: Trickbot Downloader Username Check
- string: /Timmy/i
description: Trickbot Downloader Username Check
- string: /WIN7-TRAPS/i
description: Trickbot Downloader Username Check
- string: /WDAGUtilityAccount/i
description: Windows Defender Application Guard
- string: /HAL9TH/i
description: Windows Defender Emulator