disable for dynamic scope

mandiant · Oct 4, 2024 · 0228c36 · 0228c36
1 parent 2317949
commit 0228c36
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/anti-analysis/anti-vm/vm-detection/check-for-unmoving-mouse-cursor.yml b/anti-analysis/anti-vm/vm-detection/check-for-unmoving-mouse-cursor.yml
@@ -6,7 +6,7 @@ rule:
       - BitsOfBinary
     scopes:
       static: function
-      dynamic: thread
+      dynamic: unsupported  # too broad using thread scope, see #941
     att&ck:
       - Defense Evasion::Virtualization/Sandbox Evasion::User Activity Based Checks [T1497.002]
     mbc: