10-10-2026, 03:26 AM
As you know, malware is often ran in a container/sandbox to analyze it's behavior and so, all sorts of tricks are used to get around these. The most simple method is to just delay execution (something like sleep won't work since these containers speed up time) so instead you do random shit to waste time, to put it simply. To avoid getting marked as 'idle' they will often do random stuff like calling random APIs a bunch of times, ofc it's not just delaying execution, some will look for "clues" that it's running inside a container and self terminate or it will pointlessly use a lot of disk space or memory, more than the container can afford. Just to make it clear if it's somehow not already, I'm not talking about detecting ordinary virtual machines.
If you want to detect these in a way that is more comfortable, there is a pretty convenient way to test it...
Create a new project, and use something that's detected at runtime, like an old detected UAC bypass for example:
As soon as you set the value to something like "cmd.exe", it will get detected at runtime, great.. that's what we want in this case lol
If you upload this to virustotal(ofc it distributes, so don't upload your malware here, but for testing an anti container its fine), go to 'behavior', you'll see a sigma rule detection of the known UAC bypass technique. Now... just add your anti container logic before it, this can be like... anything you can fucking think of xdd
Upload it again, if the sigma rule or other behavior detection has not detected the UAC bypass but at the same time, if you deploy it on a real endpoint, windows defender will still detect it in runtime, congrats! Your anti container trick worked :O
ofc this won't work on EVERY container, not even close, that's why malware uses many of these tricks at once. Also, note that to test this properly on a real endpoint, you'll have to obfuscate the strings related to the known UAC bypass technique, you don't want it to get detected on disk, but rather on runtime, to let you test it properly.
If you want to detect these in a way that is more comfortable, there is a pretty convenient way to test it...
Create a new project, and use something that's detected at runtime, like an old detected UAC bypass for example:
Code:
HKCU:\software\classes\ms-settings\shell\open\command (default)As soon as you set the value to something like "cmd.exe", it will get detected at runtime, great.. that's what we want in this case lol
If you upload this to virustotal(ofc it distributes, so don't upload your malware here, but for testing an anti container its fine), go to 'behavior', you'll see a sigma rule detection of the known UAC bypass technique. Now... just add your anti container logic before it, this can be like... anything you can fucking think of xdd
Upload it again, if the sigma rule or other behavior detection has not detected the UAC bypass but at the same time, if you deploy it on a real endpoint, windows defender will still detect it in runtime, congrats! Your anti container trick worked :O
ofc this won't work on EVERY container, not even close, that's why malware uses many of these tricks at once. Also, note that to test this properly on a real endpoint, you'll have to obfuscate the strings related to the known UAC bypass technique, you don't want it to get detected on disk, but rather on runtime, to let you test it properly.