Gamaredon Ptero-family Sandbox/VM Evasion via PowerShell Timing and WMI Checks
Detects the execution of PowerShell or Windows Script Host (wscript/cscript) scripts that contain patterns indicating evasion techniques. Specifically, this rule identifies the combined use of execution delays (e.g., Start-Sleep, WScript.Sleep, ping/timeout) and environment/sandbox fingerprinting (e.g., WMI queries for ComputerSystem, hypervisor detection, or CPUID) often used by malware to detect virtual environments before executing malicious payloads (typically via IEX or Invoke-Expression).
Splunk (SPL)
