Log in Request a demo

Attack technique

Virtualization/Sandbox Evasion

Virtualization/Sandbox Evasion is when malware checks whether it is running inside a virtual machine or an analysis sandbox, and changes what it does if it is.

In short

Virtualization/Sandbox Evasion is when malware checks whether it is running inside a virtual machine or an analysis sandbox, and changes what it does if it is. The aim is to avoid being studied. MITRE lists it under both Stealth and Discovery.

Last updated 8 October 2026

Profile MapTechnique
  1. Reconnaissance
  2. Resource Development
  3. Initial Access
  4. Execution
  5. Persistence
  6. Privilege Escalation
  7. Stealth
  8. Defense Impairment
  9. Credential Access
  10. Discovery
  11. Lateral Movement
  12. Collection
  13. Command and Control
  14. Exfiltration
  15. Impact
  1. MITRE IDT1497ATT&CK technique
  2. Detection4ways to spot itLook for environment checks · Cover all platforms
  3. Defences2ways to stop itUse behavior-based monitoring

How it works

Security teams often run suspicious files in a sandbox or virtual machine to see what they do. Attackers know this, so their code looks for signs that it is being watched.

The checks can look for security monitoring tools, other traces of a virtual machine, or a lack of normal user activity. Some malware also waits for a while before doing anything, hoping a short sandbox run will end first.

If the code decides it is in an analysis environment, it may stop, hide its main functions, or hold back further payloads. What it learns can also shape what it does next on a real victim system.

MITRE lists three sub-techniques: T1497.001 System Checks; T1497.002 User Activity Based Checks; T1497.003 Time Based Checks.

A real example

Procedure examples listed by MITRE ATT&CK:

  • Agent Tesla can perform anti-sandboxing and anti-virtualization checks.
  • Bumblebee can perform anti-virtualization checks.
  • Raspberry Robin carries real and fake second-stage payloads, and delivers the real one only if it decides it is not running in a virtualized environment.
  • Bazar can try to overload sandbox analysis by sending 1550 calls to printf.
  • Black Basta can make a random number of calls to the kernel32.beep function to hinder log analysis.

How to detect

  1. Look for environment checks

    Watch for commands or system calls that look for virtualization traces, such as virtual devices, services or hardware details, shortly before a payload runs.

  2. Notice delays and skipped execution

    Long sleeps, loops or code that quits early without doing its job can point to a program trying to outlast a sandbox.

  3. Cover all platforms

    MITRE describes checks on Windows, Linux and macOS, so monitoring should include scripts and programs that probe hypervisor or system information on each.

  4. Detection strategy MITRE lists

    DET0046, Detection Strategy for T1497 Virtualization/Sandbox Evasion.

How to defend

  1. Plan around detection, not prevention

    MITRE says this technique cannot easily be stopped with preventive controls because it abuses normal system features.

  2. Use behavior-based monitoring

    Rely on monitoring that spots the checks and delays themselves, instead of relying only on what a sandbox run shows.

Questions

What is Virtualization/Sandbox Evasion?

It is when malware checks whether it is running inside a virtual machine or an analysis sandbox, and changes what it does if it is. The aim is to avoid being studied.

How does malware detect a sandbox?

The checks can look for security monitoring tools, other traces of a virtual machine, or a lack of normal user activity. Some malware also waits a while before acting, hoping a short sandbox run will end first.

What does malware do when it finds a sandbox?

It may stop, hide its main functions, or hold back further payloads. What it learns can also shape what it does next on a real victim system.

How can defenders detect sandbox evasion?

Watch for commands or system calls that look for virtualization traces shortly before a payload runs, and for long sleeps or code that quits early without doing its job. Monitoring should cover Windows, Linux and macOS.

In our research

  1. TA577 (Hive0118): The Evolving Phishing Specialist Behind Modern Malware Campaigns January 2026
  2. BugSleep Backdoor Technical Analysis December 2025
  3. Stone Gaze: In-Depth Analysis of Medusa Ransomware July 2024
  4. [Research Summary]: RokRat June 2024
  5. Xehook Stealer Technical Analysis June 2024
  6. Phemedrone Stealer Technical Analysis March 2024

Sources

  1. MITRE ATT&CK T1497: Virtualization/Sandbox Evasion MITRE
  2. MITRE ATT&CK TA0007: Discovery MITRE

Browse the threat library

Keep exploring

Knowledge Hub

Article

BugSleep Backdoor Technical Analysis

Technical analysis of the BugSleep backdoor attributed to MuddyWater: file transfer, reverse shell commands, scheduled task persistence and detections.

Read more

Glossary term

Sandbox

A sandbox is a restricted, controlled environment where software can run without reaching the rest of a system.

Read more

Malware

Black Basta

Black Basta is ransomware, offered to criminal affiliates as a service, that encrypts files on Windows and VMware ESXi systems and steals data to pressure victims into paying.

Read more