← Back to ATT&CK index
T1497.001sub-technique
Virtualization/Sandbox Evasion: System Checks
View on attack.mitre.org →3 syscalls implement this technique
- NtIsProcessInJob
Tests whether a process is running inside a specific (or any) job object.
- NtGetCurrentProcessorNumber
Returns the zero-based logical-processor index the calling thread is currently executing on.
- NtQueryInformationJobObject
Retrieves accounting, limits or UI-restriction information about a job object.