Gamaredon PteroSand Sandbox Evasion – WMI VM/Timing Checks from PowerShell

Ibrahim Saud@tektrix

•updated Jun 26, 2026•1•0•3

Detects the use of common scripting engines (PowerShell, WScript, CScript, MSHTA) to perform system fingerprinting, sandbox detection, or execution timing delays. This activity is often indicative of early-stage malware or reconnaissance tools attempting to identify if they are running in a virtual or analysis environment before proceeding with malicious activity.