PowerShell Detect Virtualization Environment via WMI Queries

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•25

This rule detects PowerShell scripts attempting to identify a virtualization or sandbox environment. It specifically looks for the use of WMI objects like 'MSAcpi_ThermalZoneTemperature' and 'Win32_ComputerSystem' in PowerShell script block text, which are commonly queried by malware to determine if it's running in a virtualized environment.