Gamaredon PteroSand Sandbox Evasion via WMI VM Check and Sleep Delay in PowerShell
Detects sandbox evasion techniques used by the Gamaredon group's PteroSand malware. The rule monitors for WMI queries against system artifacts (Win32_ComputerSystem, Win32_BIOS, or Win32_VideoController) searching for virtualization-related strings (vmware, vbox, etc.), followed by a mandatory sleep/timeout delay of at least 60 seconds, and concludes by identifying the subsequent execution of a new process within the same lineage.
YARA-L
