Gamaredon PteroSand PowerShell WMI VM and Sandbox Environment Evasion
Detects the execution of PowerShell commands that query system hardware and environment configurations often used by malware for sandbox detection, virtualization identification, or anti-analysis checks. The rule looks for queries related to VM guest tools (VMware, VirtualBox), BIOS/BaseBoard information, CPU core counts, total memory, and environment variables related to sandbox artifacts.
CQL
