mandiant / mandiant/capa-rules
rule idea: Identifying virtual environments via mac address
@williballenthin is already working on this.
Since Jul 24, 2020.
- Dominant language
- No language data
- Stars
- 736
- Forks
- 245
- Avg merge
- 4d 53m
- Merged PRs (30d)
- 2
Description
Hello,
Could be interesting maybe include **vm detection using mac address** api call like "**UuidCreateSequential**"
Suggestion link:
https://nakedsecurity.sophos.com/2016/12/13/nymaim-using-mac-addresses-to-uncover-virtual-environments-and-bypass-antivirus
```
rule:
meta:
name: Identifying virtual environments via mac address
namespace: anti-analysis/anti-vm/vm-detection
author: andrea
scope: basic block
att&ck:
- Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]
mbc:
- Anti-Behavioral Analysis::Virtual Machine Detection::Unique Hardware/Firmware Check
references:
- https://nakedsecurity.sophos.com/2016/12/13/nymaim-using-mac-addresses-to-uncover-virtual-environments-and-bypass-antivirus
features:
- and:
- basic block:
- and:
- api: UuidCreateSequential
- optional:
- or:
- mnemonic: cmp
- mnemonic: jz
- mnemonic: xor
```
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.