nerdexam
GIAC

GCIH · Question #395

You just acquired admin rights on a remote machine and gained remote access. What techniques would you use to determine if it is a virtual machine?

The correct answer is C. Look at the system's registry, its memory, its hardware, and its processor instructions. Detecting a virtual machine requires examining low-level system artifacts that hypervisors cannot fully conceal, such as registry keys, hardware signatures, and CPU behavior.

Vulnerability Exploitation & Privilege Escalation

Question

You just acquired admin rights on a remote machine and gained remote access. What techniques would you use to determine if it is a virtual machine?

Options

  • ALook at the system's firewall settings, running services, IO settings, and disk activity
  • BLook at the system's processor utilization, network card settings, open ports, and logged on users
  • CLook at the system's registry, its memory, its hardware, and its processor instructions
  • DLook at the system's OS version, patch status, network card activity, and hardware drivers

How the community answered

(46 responses)
  • A
    4% (2)
  • B
    4% (2)
  • C
    78% (36)
  • D
    13% (6)

Why each option

Detecting a virtual machine requires examining low-level system artifacts that hypervisors cannot fully conceal, such as registry keys, hardware signatures, and CPU behavior.

ALook at the system's firewall settings, running services, IO settings, and disk activity

Firewall settings, running services, IO settings, and disk activity are not reliable VM indicators because they reflect OS configuration, not the underlying virtualization layer.

BLook at the system's processor utilization, network card settings, open ports, and logged on users

Processor utilization, open ports, and logged-on users are runtime metrics unrelated to whether the underlying platform is virtualized.

CLook at the system's registry, its memory, its hardware, and its processor instructionsCorrect

Virtual machines leave detectable traces in the Windows registry (e.g., keys referencing VMware, VirtualBox, or Hyper-V), report virtual hardware in memory structures, expose vendor-specific virtual devices, and respond differently to CPU instructions like CPUID - which can reveal the presence of a hypervisor via the ECX bit 31 flag. These low-level indicators are the standard forensic and red-team methods for VM fingerprinting.

DLook at the system's OS version, patch status, network card activity, and hardware drivers

OS version, patch status, and network card activity reflect software state and do not expose the hypervisor artifacts needed to identify a VM.

Concept tested: Virtual machine detection via low-level system artifacts

Source: https://attack.mitre.org/techniques/T1497/

Topics

#VM detection#virtualization artifacts#registry analysis#post-compromise analysis

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GCIH Practice