WMI BIOS/Hardware Query for Sandbox or VM Evasion (T1497.001)

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•0

Detects the use of WMIC to query system information, such as BIOS, computer system, or product details. Adversaries often use this technique during the discovery phase to gather information about a target host's hardware and environment.