npm RAT WMI Sandbox Evasion via python.exe or chost.exe Spawning wmic/PowerShell

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•0

Detects the use of wmic.exe or powershell.exe by common scripting interpreters (python.exe, chost.exe) to query system information via WMI, specifically targeting hardware identifiers (Win32_ComputerSystem, Win32_NetworkAdapterConfiguration) or MAC addresses. This behavior is indicative of virtualization or sandbox evasion techniques, where malware attempts to identify if it is running within an analysis environment by checking hardware signatures.