Detecting the operation of a virtual machine by identifying seed candidates from sets of random numbers generated at a computer, where each of the sets includes multiple random numbers, identifying candidate performance counter frequencies from the seed candidates and from timing information associated with the sets of random numbers, and determining that the computer is operating as a virtual machine if any of the candidate performance counter frequencies is consistent with a predefined virtual machine performance counter frequency.