Malware that checks whether it is running in a sandbox is old news, but the same samples now also try to talk their way past the AI models that defenders use to triage them. MITRE ATLAS tracks environment-aware evasion as AML.T0097 Virtualization/Sandbox Evasion, in the Defense Evasion tactic (AML.TA0007). It mirrors ATT&CK T1497, whose general mechanics (system, user activity and time-based checks) are covered in the MITRE ATT&CK T1497 Virtualization/Sandbox Evasion guide. This page covers only the AI angle: the ATLAS case that pairs sandbox checks with an attack on LLM-based analysis, payloads that call LLMs at runtime, and what this means for sandboxes and AI triage pipelines that defenders run. It is for malware analysts, detection engineers and teams building AI-assisted security tooling.
Key takeaways
- ATLAS added this technique because of AI analysis. Its single reference is Check Point Research's report on a malware prototype that combined sandbox checks with a prompt injection aimed at LLM-based malware analysis.
- The checks themselves are classic. ATLAS lists registry keys, environment variables, MAC address prefixes and running processes that reveal VMware, VirtualBox, QEMU or Parallels, plus checks for analysis tools.
- Runtime LLM calls weaken one-shot verdicts. Google's threat intelligence group reported malware that asks an LLM for new code during execution, so one sandbox run may not show what the next run does.
- No ATLAS mitigation is mapped. As of release 2026.10 no AML.M mitigation targets AML.T0097; defence comes from hardened analysis environments, layered verdicts and treating sample content as untrusted input to AI tools.
- Evasion is itself a signal. Environment fingerprinting, and calls to LLM APIs from unexpected processes, are detectable on real endpoints.
What ATLAS records
ATLAS created AML.T0097 in November 2025, last modified it in May 2026 and rates it as realized. The description covers malware that looks for virtual machine or sandbox artefacts and then disengages, hides its core functions, or holds back secondary payloads. Examples given are registry substrings matching VMware, VBOX or QEMU; environment variables matching VBOX, VMWARE or PARALLELS; NIC MAC prefixes 00-05-69 (VMware) and 08-00-27 (VirtualBox); processes such as vmware.exe, vboxservice.exe and qemu-ga.exe; and monitoring tools such as Sysinternals or Wireshark. One related technique is tracked separately: AML.T0107 Exploitation for Defense Evasion, which covers exploiting a software flaw to get past defences (see AML.T0107 Exploitation for Defense Evasion).
The ATLAS case: sandbox checks plus an attack on AI analysis
ATLAS links one case study, Malware Prototype with Embedded Prompt Injection (AML.CS0043), reported by Check Point Research in June 2025. The sample, called Skynet, was uploaded to VirusTotal from the Netherlands and looked unfinished.
| Behaviour | ATLAS technique | What Check Point reported |
|---|---|---|
| Environment checks | AML.T0097 | Hypervisor CPUID flag, BIOS manufacturer and disk enumeration registry values, VM environment variables, VM vendor MAC prefixes and VM processes; exits if not run from an expected temp directory |
| Text aimed at an AI analyser | AML.T0065, AML.T0051.000, AML.T0015 Evade AI Model | Embedded natural-language instructions meant to make an LLM reviewing the code drop its task and return a benign verdict |
| Credential and file collection | AML.T0037, AML.T0055 | Read SSH known_hosts, SSH private key and hosts files, but only printed them |
| Concealment | Not mapped to AML.T0097 | XOR and Base64 string obfuscation, opaque predicates, an embedded Tor client used as a local proxy |
The prompt injection failed: Check Point tested two OpenAI models and both kept their analysis task. Check Point's conclusion is the useful part for defenders: as security products adopt generative AI, attempts to evade AI analysis are likely to grow, following the path sandbox evasion took. A sandbox verdict and an AI verdict are now both targets, and the same sample can try to beat both.
Payloads that call LLMs at runtime
Google Threat Intelligence Group's AI Threat Tracker, published 5 November 2025, describes malware families that query LLMs during execution. These are relevant to sandbox evasion because behaviour is decided at runtime, outside the sample.
| Family (GTIG name) | Status reported | Runtime LLM use | Why it matters for sandbox verdicts |
|---|---|---|---|
| PROMPTFLUX | Experimental | VBScript dropper asking an LLM API for new obfuscated, evasive code, in one variant rewriting its whole source hourly | The code analysed today may not be the code that runs tomorrow |
| PROMPTSTEAL (CERT-UA: LAMEHUG) | Observed in operations, attributed to APT28 | Asks a model hosted on Hugging Face for one-line Windows commands rather than carrying them | Commands are not in the binary; static analysis sees only a prompt |
| PROMPTLOCK | Experimental proof of concept | Generates and runs Lua scripts at runtime | Behaviour varies with the model response |
| FRUITSHELL | Listed in the same GTIG report | No runtime calls; contains hard-coded prompts meant to mislead LLM-based analysis | Same aim as the Skynet case |
Two practical consequences follow. A payload that needs a live LLM API may simply do nothing in a sandbox without internet access, which looks like evasion even without explicit checks. And outbound calls to LLM APIs from a process that has no business making them are a strong detection signal, because the payload must reach a model and, as GTIG notes for PROMPTSTEAL, often uses stolen API tokens to do so.
Where this hits AI-assisted defence
- LLM triage of sandbox output: if strings, comments or decompiled code from a sample are fed straight into a model prompt, the sample is writing part of the prompt. Treat all sample content as untrusted data, as you would retrieved documents. See the AML.T0051 LLM Prompt Injection guide.
- AI verdicts as a single gate: a "benign" from an LLM should never override a sandbox, static or reputation signal; combine them.
- Vetting agent tools and MCP servers: if you run third-party agent tools or MCP servers in a sandbox before approving them, environment-aware code can behave well during vetting. Keep runtime monitoring after approval. See the AI Agent Sandboxing and Code Execution Guide.
- Agent hosts as a target: hosts that run agents hold model API keys and tool tokens; collection of those secrets is what Skynet attempted after its checks.
Detection
| Data source | Signal |
|---|---|
| EDR and Sysmon process and registry telemetry | Bursts of reads of BIOS, disk enumeration and hypervisor-related registry values, VM vendor process checks or analysis-tool checks, followed by early exit |
| Network and proxy logs | Calls to LLM provider or model hub inference APIs from script hosts (wscript, cscript, powershell), unsigned binaries or processes outside the approved AI client list |
| AI provider and gateway logs | Your organisation's API keys used from unexpected hosts, or prompts requesting obfuscation or command generation |
| Sandbox reports | Samples with environment fingerprinting and little other behaviour; samples containing natural-language instructions addressed to an analyser |
| AI triage pipeline logs | Model verdicts that disagree with sandbox or static results; model outputs that echo instructions found in the sample |
Measuring it
- Disagreement review: share of AI-versus-sandbox verdict disagreements reviewed by an analyst.
- Low-activity re-runs: share of samples with fingerprinting and no payload that are re-detonated in a hardened or bare-metal environment.
- LLM egress coverage: share of endpoints where outbound LLM API traffic is attributed to a process.
- Key misuse alerts: time to detect an organisation API key used from an unapproved host.
- Prompt hygiene: share of AI triage prompts that wrap sample content as quoted data with an instruction to ignore embedded directives, verified by tests.
Hardening the analysis side
| Control | Against | How |
|---|---|---|
| Remove obvious VM artefacts | System checks (T1497.001) | Change default MAC prefixes, BIOS and disk strings, remove guest tools where possible; see the Malware Sandbox Guide |
| Realistic environment | User activity and time checks (T1497.002, T1497.003) | Simulated user activity, aged profiles, longer runs, varied clocks |
| Controlled LLM egress in detonation | Payloads that need a model | Detonate once with LLM API access through a monitoring proxy to capture prompts and responses, under an isolated test key, so behaviour that depends on the model is visible |
| Layered verdicts | Prompt injection in samples (AML.T0015 via AML.T0051) | AI verdict is one input; static, sandbox and reputation signals must agree |
| Untrusted-input handling in AI triage | Instructions embedded in samples | Delimit sample content, strip or flag natural-language instructions, test with benign injected strings |
| Endpoint detection beyond the sandbox | Everything that passed the sandbox | Behavioural EDR on real endpoints, where the payload does run |
How to implement and test
- Map your analysis chain: list where samples are detonated, where AI models read sample content, and which verdict wins.
- Fix the precedence: make sure no single AI verdict can close a case without corroboration.
- Harden the sandbox: remove the artefacts ATLAS lists, then test with a benign environment-check tool from your sandbox vendor or open-source test suites.
- Test the AI triage: submit benign files that contain harmless embedded instructions (for example, asking the model to add a marker word) and confirm the model ignores them.
- Add LLM egress detection: build an allowlist of processes permitted to call LLM APIs and alert on others; pilot in alert-only mode for two weeks before blocking.
- Roll back safely: keep previous sandbox images and triage prompt versions so a change that raises false negatives can be reverted.
Decision guidance
| Situation | Priority (our recommendation) |
|---|---|
| You use LLMs to triage malware or alerts | Untrusted-input handling, layered verdicts, injection tests |
| You run an in-house sandbox | Artefact removal, realistic environments, a monitored LLM egress path for detonation |
| You rely on a commercial or online sandbox | Ask how it handles evasive and LLM-calling samples; add endpoint behavioural detection; see Online malware analysis services |
| Small organisation without a sandbox | EDR on every endpoint, LLM API egress allowlisting, provider spend and key-use alerts |
Where identity fits
The identity angle is the API key. GTIG reports PROMPTSTEAL likely used stolen API tokens to reach its model, and PROMPTFLUX carries an API key inside the script. An organisation's own model API keys can become an attacker's runtime engine, and keys on analysis hosts or agent hosts are what collection steps go after. Scope keys per application, restrict them by network, watch spend and use, and revoke on any sign of misuse. See the OpenAI API Keys Security Guide and the Anthropic API Keys Security Guide.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| MITRE ATLAS | AML.T0097 (AML.TA0007 Defense Evasion); with AML.T0065, AML.T0051.000, AML.T0015 in AML.CS0043 | Technique and the recorded chain |
| MITRE ATT&CK | T1497, T1497.001, T1497.002, T1497.003; related T1518.001, T1027 | Enterprise mirror and related evasion |
| NIST SP 800-53 Rev. 5 | SC-44 Detonation Chambers, SI-3, SI-4, SC-7, CA-8 | Sandboxing, malicious code protection, monitoring, egress, testing |
| NIST CSF 2.0 | DE.CM-09, DE.AE-02 | Runtime monitoring, analysis of adverse events |
Common failure patterns
- Default VM images: sandboxes that still show VirtualBox MAC prefixes, guest tools and vendor BIOS strings.
- "Nothing happened" read as "benign": closing samples that fingerprinted the environment and stopped.
- Sample text pasted into prompts: AI triage that gives sample strings the same standing as analyst instructions.
- AI verdict as the final word: automation that auto-closes on a model's benign verdict.
- No view of LLM egress: no way to tell which process on an endpoint is calling a model API.
- Vetting once: approving agent tools or MCP servers after a sandbox run and never monitoring them in production.
Practitioner checklist
- Remove the VM artefacts ATLAS lists from analysis environments and re-test.
- Re-detonate fingerprinting samples in a hardened or bare-metal environment.
- Treat sample content as untrusted input in every AI triage prompt and test it.
- Require corroboration before an AI verdict closes a case.
- Allowlist processes that may call LLM APIs and alert on others.
- Scope, restrict and monitor the organisation's model API keys.
- Keep behavioural EDR on real endpoints for what sandboxes miss.
- Monitor approved agent tools and MCP servers after the vetting sandbox.
Standards and references
- MITRE ATLAS: Virtualization/Sandbox Evasion
- MITRE ATLAS: Malware Prototype with Embedded Prompt Injection
- MITRE ATT&CK: T1497 Virtualization/Sandbox Evasion
- Check Point Research: In the Wild: Malware Prototype with Embedded Prompt Injection
- Google Threat Intelligence Group: GTIG AI Threat Tracker
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls
Related NHI Mgmt Group resources: MITRE ATLAS Guide · Malware Analysis Guide for Defenders · EDR Evasion and Defence Guide · MITRE ATLAS AML.T0068 LLM Prompt Obfuscation