Linux: Unauthorized Virtual Machine Fingerprinting

Adversaries often perform VM fingerprinting to tailor malicious activity or evade sandbox detection. This activity involves non-root users accessing specific Linux system files to enumerate virtual hardware identifiers. This technique has been observed in the wild by threat actors utilizing the Pupy RAT.

Impact

Successful VM fingerprinting allows adversaries to detect virtualized environments, enabling them to alter their execution path to avoid detection by automated analysis systems or to tailor their payload to the specific target environment.

Recommendation

• Implement process monitoring on Linux endpoints to detect non-root processes querying hardware configuration files in /sys and /proc directories.
• Review the process execution lineage of any alert to confirm if the activity aligns with legitimate administrative or inventory tooling.
• Configure an allowlist for known-good management agents or monitoring utilities that legitimately query system hardware.
• Ensure endpoint logging (Auditd, Elastic Defend, or equivalent) captures process arguments to differentiate between unauthorized reconnaissance and system-level inventory.