WMIC Query of System Manufacturer/Model for Anti-VM Detection
Detects the use of the Windows Management Instrumentation Command-line (WMIC) utility to query system manufacturer or model information. This behavior is commonly employed by malware as an anti-virtualization or anti-sandbox technique to identify if it is running in a virtual machine environment by checking for known hypervisor-related strings in hardware identifiers.
Sigma
