T1497StealthDiscovery
Virtualization/Sandbox Evasion
Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They…
CVEs6
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.4
Reports0
CVEs linked to Virtualization/Sandbox Evasion
6 CVEs, by priority. Each link shows its badge.- CVE-2015-3113Adobe Flash Player Heap-Based Buffer Overflow VulnerabilityAdobe · Flash PlayerKEVPublic exploitCritical · 9.8T1497Virtualization/Sandbox EvasionT1622Debugger Evasion+1 more · 3 reportsMITRE CTID mapping of the KEV entry · follow-on activity99.8%Top 0.04%77.6priority
- CVE-2025-6558Google Chromium ANGLE and GPU Improper Input Validation VulnerabilityGoogle · ChromiumKEVPublic exploitHigh · 8.8T1189Drive-by CompromiseT1203Exploitation for Client Execution+1 moreMITRE CTID mapping of the KEV entry · primary impact10.9%Top 4.1%68.3priority
- CVE-2025-2783Google Chromium Mojo Sandbox Escape VulnerabilityGoogle · Chromium MojoKEVPublic exploitHigh · 8.3T1203Exploitation for Client ExecutionT1548Abuse Elevation Control Mechanism+1 moreMITRE CTID mapping of the KEV entry · follow-on activity9.2%Top 4.7%67.9priority
- CVE-2014-0546Adobe Reader and Acrobat Sandbox Bypass VulnerabilityAdobe · Reader and AcrobatKEVEnd of lifeCritical · 9.8T1068Exploitation for Privilege EscalationT1497Virtualization/Sandbox EvasionMITRE CTID mapping of the KEV entry · primary impact22.3%Top 2.3%49.4priority
- CVE-2020-0981A security feature bypass vulnerability exists when Windows fails to properly handle token relationships.An attacker…Microsoft · Windows 10 Version 1909 for 32-bit SystemsPublic exploitT1134Access Token ManipulationT1068Exploitation for Privilege Escalation+1 moreMITRE CTID mapping of the CVE · follow-on activity1.3%Top 30%19.0priority
- CVE-2018-8489A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input…Microsoft · Windows 7T1497Virtualization/Sandbox EvasionMITRE CTID mapping of the CVE · primary impact4.4%Top 8.7%18.3priority