Public malware techniques used in the wild: Virtual Machine, Emulation, Debuggers, Sandbox detection.

Evasions encyclopedia gathers methods used by malware to evade detection when run in virtualized environment. Methods are grouped into categories for ease of searching and understanding. Also provided are code samples, signature recommendations and countermeasures within each category for the described techniques.

.NET Project containing plenty of advanced techniques to detect various types of malicious actions on your software, with syscall support.

A tool to detect and crash Cuckoo Sandbox

This script allows you to create various artifacts on a bare-metal Windows computer in an attempt to trick malwares that looks for VM or analysis tools

Detects virtual machines and malware analysis environments

Anti Virtulization, Anti Debugging, AntiVM, Anti Virtual Machine, Anti Debug, Anti Sandboxie, Anti Sandbox, VM Detect package.

A Malware Scarecrow for Windows 10/11 with a user-friendly touch.

Detect virtual environment

Some anti QEMU trick used by in-the-wild malware.

Binary obfuscation, anti-reversing, anti-debugging and av-bypass framework for Windows

Apate performs anti-debugging, anti-VM and anti-sandbox tests, to see if your linux system is able to stay under the radar.

Some anti-sandbox techniques implemented in Golang.

A pintool for protecting a sandbox application of common anti-virtualmachine and anti-sandbox detection techniques

Effective cloud sandbox detection from ring 3

This repository contains the c# code which is using latest persistence technique and multiple anti-vm, anti-sandboxes techniques. Creating persistence by using WindowsApps folder, schtasks, powershell cmdlet (Get-Variable).

Public malware techniques used in the wild: Virtual Machine, Emulation, Debuggers, Sandbox detection.

Anti Virtulization, Anti Debugging, AntiVM, Anti Virtual Machine, Anti Debug, Anti Sandboxie, Anti Sandbox

A lightweight JavaScript library for protecting web-based exam pages from unauthorized access via emulators, virtual machines, and sandboxes. It combines device motion verification with advanced VM/sandbox detection — no installation needed, purely client-side, ensuring exam integrity on real devices only.