TA4922 SilentRunLoader VM/Sandbox Evasion Checks via Python

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects Python-based execution of system binaries (wmic.exe, reg.exe, tasklist.exe, systeminfo.exe) used for environment reconnaissance, specifically targeting VM and sandbox detection artifacts characteristic of the SilentRunLoader malware.