BeepRAT WMI Sandbox Detection via Win32_OperatingSystem and VM Registry Queries
Detects suspected sandbox evasion techniques commonly utilized by BeepRAT malware. The rule monitors for WMI queries related to hardware/OS virtualization artifacts (e.g., CIM_Memory, Win32_OperatingSystem), registry enumeration of virtualization keys (VMware/VirtualBox), and suspicious child process spawning of wmiprvse.exe by known loader components (HFY.exe, tcc.exe, LuaJit.exe).
SentinelOne
