BIOC
Informational
✕
Evasion using time-based properties
Attackers may check Event Log to evade virtualized environments.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Evasion
- Status:
- Enabled
ATT&CK tactics: Defense Evasion (TA0005) Discovery (TA0007)
ATT&CK techniques: Virtualization/Sandbox Evasion: Time Based Checks (T1497.003)
Indicator:
Process action type = execution AND target process name = powershell.exe , powershell_ise.exe , pwsh.exe AND target process cmd = *get-winevent*6005*
Preventable: yes