Emulation Detection

Definitions

1. Techniques used by malware to determine whether it is running in an emulator, sandbox, or analysis environment rather than on a normal victim system. If emulation detection succeeds, the malware may stay dormant or alter behavior to frustrate analysts.

   In plain English: A malware trick for noticing it is being analyzed in a fake environment.

   Example: "The sample used emulation detection and refused to unpack unless it saw signs of a real user environment."

Related Terms

• Domain Fronting
• Encoded Payload
• Fileless Malware
• Living off the Land
• Obfuscation
• Covert Channel
• Import Hash
• Polymorphic Malware