PowerShell Memory Check for Sandbox Evasion

Aaron Beardslee@abeardslee

•updated Jan 28, 2026•1•0•24

Detects PowerShell scripts that query the system's total physical memory and compare it against common low-resource thresholds (e.g., < 4GB). This is a known sandbox evasion technique used by malware to identify and avoid analysis environments, which are often configured with limited RAM.