Hello everyone, is there a way/query to check if a device is a virtual machine?

Something that can be used to determine if a host is a VM is to use the

system_table

to check the hardware manufacture of the device. If it is a VM, you will end up getting names of VM vendors (Vmware, Virtualbox, etc) VM host

osqueryi.exe "select hardware_model from system_info"
+----------------+
| hardware_model |
+----------------+
| VMware7,1      |
+----------------+

Physical host

osqueryi.exe "select hardware_model from system_info"
+---------------------+
| hardware_model      |
+---------------------+
| HP Laptop 15-dw3xxx |

Yeah I already saw this column but it is just empty for my VM. Is this VM configuration related?

That's odd! What happens if you run

osquery

with

sudu

... or without if you already were? Is it just that column that comes up empty, or do you get all blank if you

osqueryi.exe "select * from system_info"

Omg yeah with sudo the query works... Thanks a lot!