The trick is to become a company like "CrowdStrike", get your crappy software that runs at kernel level signed, then you can run all of the "suspicious" calls t

The trick is to become a company like "CrowdStrike", get your crappy software that runs at kernel level signed, then you can run all of the "suspicious" calls to sys apis all you want. Forget determining if it’s a VM or not. Just push untested code/releases on production machines across all of your customers. Then watch the world burn, flights get delayed, critical infrastructure gets hammered, _real_ people get impacted. _Legitimate_ companies have done more damage to American companies than black hat hackers or state actors can ever dream of. The folks behind xz util within libzma aspire to cause the amount of damage companies like ClownStrike and SolarWinds have caused.