Virtualization/Sandbox Evasion
Technique · ATTACK:enterprise:T1497
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1497",
"title": "Virtualization/Sandbox Evasion",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T1497",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--82caa33e-d11a-433a-94ea-9b5a5fbef81d",
"external_id": "T1497",
"domain": "enterprise",
"created": "2019-04-17T22:22:24.505Z",
"modified": "2026-09-11T19:27:14.200Z",
"version": "2.0",
"aliases": [
],
"tactics": [
"stealth",
"discovery"
],
"source_references": [
{
"source_name": "Unit 42 Pirpi July 2015",
"url": "https://unit42.paloaltonetworks.com/ups-observations-on-cve-2015-3113-prior-zero-days-and-the-pirpi-payload/"
},
{
"source_name": "Deloitte Environment Awareness",
"url": "https://drive.google.com/file/d/1t0jn3xr4ff2fR30oQAUn_RsWSnMpOAQc/edit"
}
]
}Explicit source assertions (30)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0380 → uses → ATTACK:enterprise:T1497
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--02a35538-7a82-4b30-94ac-e943c19acfe4
Kaspersky StoneDrill 2017ATTACK:enterprise:S0483 → uses → ATTACK:enterprise:T1497
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--03351a2c-8fa5-4a1a-9ad5-a8be376a06c8
Trendmicro_IcedIDATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1497
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--061f0d25-40fd-440a-b7e8-54ad0209f5f4
Malwarebytes Agent Tesla April 2020ATTACK:enterprise:G1052 → uses → ATTACK:enterprise:T1497
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1ad68e81-78c0-4f9a-b824-8bc85218af44
Socket HexEval BeaverTail Contagious Interview June 2025ATTACK:enterprise:G1031 → uses → ATTACK:enterprise:T1497
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1e42c88d-1513-445c-ae63-7d2a1840753f
Palo Alto Unit 42 OutSteel SaintBot February 2022ATTACK:enterprise:S0268 → uses → ATTACK:enterprise:T1497
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--20dfecf8-b324-4584-9526-9de6a14dfa27
Talos Bisonal Mar 2020ATTACK:enterprise:S0484 → uses → ATTACK:enterprise:T1497
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2c112e41-be75-4f99-84ac-ce7776f88fca
ESET Carberp March 2012ATTACK:enterprise:S1070 → uses → ATTACK:enterprise:T1497
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2f5dca6b-3cd3-4b2a-b097-7eddd80bc366
Check Point Black Basta October 2022ATTACK:enterprise:C0005 → uses → ATTACK:enterprise:T1497
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3ff416c3-63dd-4050-82f9-fcf4820a7b12
ESET Operation Spalax Jan 2021ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1497
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--421b0dc2-fc78-4eb3-a336-ce8e4febccef
TrendMicro RaspberryRobin 2022ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1497
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4d63c2b7-03e6-4747-81f2-9197faccd5fc
Cybereason Bazar July 2020ATTACK:enterprise:S0666 → uses → ATTACK:enterprise:T1497
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4f7680e9-3dd7-4365-a1cc-75342808e2c2
ESET Gelsemium June 2021ATTACK:enterprise:T1497.002 → subtechnique-of → ATTACK:enterprise:T1497
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5d6f0f0e-7479-480a-aaef-92a3e8d8b7c8
ATTACK:enterprise:S0023 → uses → ATTACK:enterprise:T1497
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5edc2d20-2e9a-4587-9656-dfe38eb1d66d
FireEye APT28ATTACK:enterprise:S0455 → uses → ATTACK:enterprise:T1497
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6176ae5b-cd96-4b15-8539-5fb6e230fd5d
Medium Metamorfo Apr 2020ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1497
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6515b62c-af1a-4b22-baca-0710ac898815
Proofpoint Bumblebee April 2022ATTACK:enterprise:S1207 → uses → ATTACK:enterprise:T1497
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6ac4c8cc-c782-4749-9d22-7c5e70ff5ce0
CheckPoint XLoader 2022 · ANY.RUN XLoader 2023ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1497
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6e2f668c-dfbd-482c-a5a7-c8ccfd378002
PaloAlto StrelaStealer 2024 · Fortgale StrelaStealer 2023ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1497
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--73d5e6ab-9d0c-4884-9db0-02033523e61a
Unit42 Redaman January 2019ATTACK:enterprise:G0012 → uses → ATTACK:enterprise:T1497
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7cc93842-6c19-4d5c-8e9b-81dfa58e859e
Lastline DarkHotel Just In Time Decryption Nov 2015ATTACK:enterprise:S0554 → uses → ATTACK:enterprise:T1497
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--89ef773b-6d5d-482e-9afd-bc892eb8093e
Cyble Egregor Oct 2020 · NHS Digital Egregor Nov 2020ATTACK:enterprise:S0046 → uses → ATTACK:enterprise:T1497
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8f88490e-346b-4462-b077-0211707c21a3
F-Secure CozyDukeATTACK:enterprise:T1497.001 → subtechnique-of → ATTACK:enterprise:T1497
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9ba97a0a-1ae5-4969-9ce4-6fb86d70fae0
ATTACK:enterprise:T1497.003 → subtechnique-of → ATTACK:enterprise:T1497
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bb1fb0c8-49f9-463c-b039-68636d507b80
ATTACK:enterprise:S1020 → uses → ATTACK:enterprise:T1497
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bb97930f-9c3a-4fac-84b1-8f954633aef0
Kaspersky Lyceum October 2021ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1497
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c398b815-5ec1-45a9-bbe8-14153ae5d703
Splunk RedLine Stealer June 2023ATTACK:enterprise:S0147 → uses → ATTACK:enterprise:T1497
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c9a7b01c-5ba6-41db-944a-ed5ba8531398
Unit 42 Gamaredon February 2022ATTACK:enterprise:S1030 → uses → ATTACK:enterprise:T1497
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e9be6f26-bcc8-49b2-b1aa-e8ce664a1fcb
ZScaler Squirrelwaffle Sep 2021 · Netskope Squirrelwaffle Oct 2021ATTACK:enterprise:S0499 → uses → ATTACK:enterprise:T1497
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f60f8552-3c43-4b43-ad23-2b00b6172b00
FireEye HancitorATTACK:enterprise:S9043 → uses → ATTACK:enterprise:T1497
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fd10197b-dc82-46b8-b600-0abebdcaa8a5
Hunt.io TeamPCP Toolkit MAY 2026