Merge pull request #942 from mandiant/mr-tz-patch-1

mr-tz · web-flow · commit 64b174e50253 · 2024-10-04T11:18:20.000+02:00
disable for dynamic scope
diff --git a/anti-analysis/anti-vm/vm-detection/check-for-unmoving-mouse-cursor.yml b/anti-analysis/anti-vm/vm-detection/check-for-unmoving-mouse-cursor.yml
@@ -6,7 +6,7 @@ rule:
       - BitsOfBinary
     scopes:
       static: function
-      dynamic: thread
+      dynamic: unsupported  # too broad using thread scope, see #941
     att&ck:
       - Defense Evasion::Virtualization/Sandbox Evasion::User Activity Based Checks [T1497.002]
     mbc:
