These notes cover the Phantom Check portion of Operation Blackout. The supplied walkthrough examines PowerShell event logs for virtualization checks. It stops after the questions below, so this post does not claim completion of any later tasks in the Sherlock.
WMI system and temperature checks
I searched Microsoft-Windows-Powershell.evtx with Chainsaw for Win32_ComputerSystem. The resulting command used Get-WmiObject -Class Win32_ComputerSystem to inspect the machine’s model and manufacturer. The class answer is Win32_ComputerSystem.
Get-WmiObject -Class Win32_ComputerSystem | Select-Object -ExpandProperty ManufacturerA second search found the WMI query used to retrieve thermal information:
SELECT * FROM MSAcpi_ThermalZoneTemperatureThe command was passed to Get-WmiObject -Query with -ErrorAction SilentlyContinue. Both the system-identification and temperature checks are examples of looking for virtualization artifacts; their presence alone does not prove how the attacker acted on the result.
Get-WmiObject -Query "SELECT * FROM MSAcpi_ThermalZoneTemperature" -ErrorAction SilentlyContinueRecover the detection script
Searching the log for virtualization terms exposed a PowerShell script block defining Check-VM. It checked multiple virtual-machine indicators in WMI, registry keys, and processes. The script block is stronger evidence of the function’s name and logic than a search hit for the word “virtual” alone.
ScriptBlockText: "function Check-VMOne registry path used to inspect services was:
HKLM:\SYSTEM\ControlSet001\ServicesThe script compared service names such as vmicheartbeat and vmicvss with virtualization indicators.
Get-ChildItem HKLM:\SYSTEM\ControlSet001\ServicesFinally, the event output contained both “This is a Hyper-V machine.” and “This is a VMWare machine.” Those are the two platform names demonstrated in the notes. The activity aligns with MITRE ATT&CK T1497.001, Virtualization/Sandbox Evasion: System Checks.
This is a Hyper-V machine.
This is a VMWare machine.