It runs at hardware speeds, and only some of the time, so not really. You can perform timing attacks, and see if you're running under a modified hypervisor, for

It runs at hardware speeds, and only some of the time, so not really. You can perform timing attacks, and see if you're running under a modified hypervisor, for example. But if you have a sniffer chip on the PCI bus or Northbridge, you won't be able to see it. Power consumption has been done as well, but you really need to know what it is you're looking for, and if it is just dormant for most of the time, how are you going to test for that?