Gamaredon Sandbox Evasion: Multi-Check Fingerprinting in PowerShell/VBScript

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•4

This rule detects potential sandbox evasion or environment analysis by identifying multiple disparate system checks (hardware, memory, processor, analysis tool, or uptime checks) performed within a short timeframe by common script interpreters like PowerShell or WScript/CScript.