unlike real hardware, it is difficult to detect VM clone. a VM clone is just a disk copy.
the common approaches to detect VM clone:
- the MAC address changed (must be changed if cloned vm hosted on the on the same network)
- Virtual Machine unique id changed. access depends on the VM vendor and host O/S. it is generally changed with a clone, but not always
- changes in the cpu configuration, memory size, number of cores, etc. this can happen without a clone.
these all count on keeping an external database of VM properties, so you can compare the current host against what is expected.