mandiant / mandiant/capa-rules

rule idea: Identifying virtual environments via mac address

Open
#50 8 comments 1 reaction 1 assignee View on GitHub

@williballenthin is already working on this.

Since Jul 24, 2020.

Dominant language
No language data
Stars
736
Forks
245
Avg merge
4d 53m
Merged PRs (30d)
2

Description

Hello,

Could be interesting maybe include **vm detection using mac address** api call like "**UuidCreateSequential**"

Suggestion link:

https://nakedsecurity.sophos.com/2016/12/13/nymaim-using-mac-addresses-to-uncover-virtual-environments-and-bypass-antivirus

```
rule:
meta:
name: Identifying virtual environments via mac address
namespace: anti-analysis/anti-vm/vm-detection
author: andrea
scope: basic block
att&ck:
- Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]
mbc:
- Anti-Behavioral Analysis::Virtual Machine Detection::Unique Hardware/Firmware Check
references:
- https://nakedsecurity.sophos.com/2016/12/13/nymaim-using-mac-addresses-to-uncover-virtual-environments-and-bypass-antivirus
features:
- and:
- basic block:
- and:
- api: UuidCreateSequential
- optional:
- or:
- mnemonic: cmp
- mnemonic: jz
- mnemonic: xor
```

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.