TA4922 Sandbox/VM Evasion via WMI VM Artifact Queries or VM Registry Key Access
Detects evidence of malware, specifically TA4922 (Atlas RAT, RomulusLoader), attempting to evade sandbox or virtualization environments. The detection monitors process command lines for WMI queries or registry artifact paths related to known hypervisor technologies such as VMware, VirtualBox, and QEMU. It requires multiple occurrences within a 5-minute window to reduce potential noise.
YARA-L
