Merge pull request #942 from mandiant/mr-tz-patch-1

disable for dynamic scope
mandiant · Oct 4, 2024 · 64b174e · 64b174e
2 parents 2317949 + 0228c36
commit 64b174e
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/anti-analysis/anti-vm/vm-detection/check-for-unmoving-mouse-cursor.yml b/anti-analysis/anti-vm/vm-detection/check-for-unmoving-mouse-cursor.yml
@@ -6,7 +6,7 @@ rule:
       - BitsOfBinary
     scopes:
       static: function
-      dynamic: thread
+      dynamic: unsupported  # too broad using thread scope, see #941
     att&ck:
       - Defense Evasion::Virtualization/Sandbox Evasion::User Activity Based Checks [T1497.002]
     mbc: