BeepRAT WMI-Based Sandbox/VM Evasion via Win32_OperatingSystem and CIM_Memory Queries
Detects WMI activity used by the BeepRAT loader to query system information (Win32_OperatingSystem, CIM_Memory), which is characteristic of virtualization and sandbox evasion techniques. The rule correlates process creation and WMI event logs with known indicators associated with BeepRAT deployment.
Microsoft Sentinel (KQL)
