Gamaredon PteroSand Sandbox Evasion via WMI Environment Fingerprinting

Ethan Andrews@eandrews

•updated Jun 25, 2026•12•0•4

Detects the execution of PowerShell or Windows script hosts containing a combination of WMI system enumeration queries (specifically targeting Win32_ComputerSystem) and common virtual machine/sandbox environment artifacts (vmware, vbox, sandbox). This behavior is consistent with the Gamaredon group's PteroSand malware performing environment fingerprinting to identify analysis environments and abort execution.