Sandbox Evasion

Technique Name	Technique ID's	Has Snippet(s)	Has Rules(s)
Detecting Running Process: EnumProcess API	U0109 U0405 U1306
GetLocalTime, GetSystemTime, timeGetTime, NtQueryPerformanceCounter	U0110 U1308 B0001.28
Time Bomb	U1005 B0007.008
GetForegroundWindow	U1301
Thermal Zone Temperature	U1302
Checking Malware Name	U1303 U0401
RDTSCP	U1304
API Hammering	U1305 B0003.012
Connected Printer	U1309 B0009.017
Detecting USB Drive	U1310 B0009.016
Detecting Hostname, Username	U1311
Checking Hard Drive Size	U1312 B0009.015
Checking Memory Size	U1313 B0009.014
Checking Installed Software	U1314
Checking Screen Resolution	U1315 B0007.006
Checking Recent Office Files	U1316 B0007.003
Checking Mouse Activity	U1317 B0007.003
Stalling Code	U1318 B0003.003
Onset Delay	U1320
VPCEXT	U1321 B0009.038
VMCPUID	U1322 B0009.037
IN	U1323 B0009.035
CPUID	U1324 B0009.034
STR	U1325 B0009.033
SMSW	U1326 B0009.032
SLDT, No Pill	U1327 B0009.031
SIDT, Red Pill	U1328 B0009.030
Checking Pipe	U1329
Detecting Hooked Function	U1330
Checking Specific Folder Name	U1331
Detecting Virtual Environment Artefacts	U1332
Detecting Virtual Environment Files	U1333
Detecting Virtual Environment Process	U1334 B0009.004
Detecting Mac Address	U1335 B0009.028
Querying the I/O Communication Port	U1336 B0009.025
Detecting Active Services	U1337
Detecting Online Sandbox	U1338
User Interaction (Are you human?)	U1339 E1204
CPU Counting	U1340 B0009.018
Domain Member	U1341
BuildCommDCBAndTimeoutA	U1342 T1497.002
Retrieve HDD Information	U1343