I've read that they specifically look for this by finding RDTSC timestamps, which would include (?) the overhead of the hypercall or something.