What MITRE ATT&CK T1497.001: System Checks (Enterprise Tactic TA0005 - Defense Evasion / TA0007 - Discovery) requires
MITRE ATT&CK T1497.001 (System Checks) is an Enterprise Defense Evasion and Discovery sub-technique of T1497 (Virtualization/Sandbox Evasion). Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Affected platforms: Linux, macOS, Windows.
Pillar: Cybersecurity · Authority: MITRE Corporation · Version: 1.0.0 · Last updated:
Primary source: https://attack.mitre.org/techniques/T1497/001/
SHA-256 integrity: 68f83b5a96f1ec738d3ffbd5f6c1923d730783b15644ca58d5e0fecf13895314
Primary Citations — 5 traced to source
- MITRE ATT&CK Technique T1497.001: System Checks (https://attack.mitre.org/techniques/T1497/001/)
- MITRE ATT&CK Tactic TA0005: Defense Evasion (https://attack.mitre.org/tactics/TA0005/)
+ 3 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access
- Discovery (free): /api/v1/nodes/mitre-attack-t1497-001-system-checks.json — 6-field metadata
- Vault (full node): /api/v1/vault/nodes/mitre-attack-t1497-001-system-checks.json — full 13-key payload, $0.01 USDC (L402/Skyfire/Direct Base)
- Canonical URL: https://bidda.com/intelligence/mitre-attack-t1497-001-system-checks
- Back to registry: Browse all 10,085 compliance nodes