BeepRAT VM/Sandbox Evasion: Registry, WMI and Sleep-Based Anti-Analysis
This rule detects the execution of specific suspicious binaries (HFY.exe or tcc.exe) or registry queries looking for common virtual machine guest additions (VMware or VirtualBox artifacts). These activities are often associated with malware attempting to detect if it is running within a virtualized or sandboxed analysis environment.
CQL
