From 2c4f1b41fb5b7cdfa5d6dbe68b2e2ecd6a2d3fa2 Mon Sep 17 00:00:00 2001
From: BitsOfBinary <48534004+BitsOfBinary@users.noreply.github.com>
Date: Sat, 18 Jul 2020 21:24:36 +0100
Subject: [PATCH] Create check-for-unmoving-mouse-cursor.yml

---
 .../check-for-unmoving-mouse-cursor.yml           | 15 +++++++++++++++
 1 file changed, 15 insertions(+)
 create mode 100644 anti-analysis/anti-vm/vm-detection/check-for-unmoving-mouse-cursor.yml

diff --git a/anti-analysis/anti-vm/vm-detection/check-for-unmoving-mouse-cursor.yml b/anti-analysis/anti-vm/vm-detection/check-for-unmoving-mouse-cursor.yml
new file mode 100644
index 00000000..49816395
--- /dev/null
+++ b/anti-analysis/anti-vm/vm-detection/check-for-unmoving-mouse-cursor.yml
@@ -0,0 +1,15 @@
+rule:
+  meta:
+    name: check for unmoving mouse cursor
+    namespace: anti-analysis/anti-vm/vm-detection
+    author: BitsOfBinary
+    scope: function
+    att&ck:
+      - Defense Evasion::Virtualization/Sandbox Evasion::User Activity Based Checks [T1497.002]
+    references:
+      - https://www.joesecurity.org/blog/5852460122427342172
+    examples:
+      - 7E17F0F35D50F49407841372F24FBD38:0x4010f6
+  features:
+    - and:
+      - count(api(user32.GetCursorPos)): 2 or more