SANDWORM_MODE Control Environment Variables Detection

Ethan Andrews@eandrews

•updated Feb 23, 2026•1•0•49

This rule detects the presence of environment variables used to control the malicious SANDWORM_MODE payload in CI environments or on local systems. The presence of these variables in a process command line is a strong indicator of an active infection or a workflow being manipulated by the malware's control logic.