Computer

Existence of a Hypervisor

Persistence

Monitor for hypervisor being present. Note that some rootkits may operate a hypervisor in such a way that hides it from the operating system, so this tool alone should be considered inconclusive if no hypervisor is reported.

SELECT UNIQUE HypervisorPresent WHERE HypervisorPresent = True

• Mitre Hypervisor

Firmware Modifications

Persistence

Monitor for suspicious BIOS properties, which may indicate malicious modification.

SELECT UNIQUE BIOSInstallDate, BIOSVersion, SMBIOSBIOSVersion, BIOSManufacturer

• Mitre System Firmware