Electron Loader GPU/Host Validation Check via WMIC or PowerShell CIM Query
Detects a trojanized Electron application performing anti-sandbox environment checks by querying GPU hardware information via WMI or PowerShell CIM cmdlets. This activity is characterized by the presence of the PYTHONUTF8 environment variable and is identified as a precursor step to attempting Microsoft Defender exclusions and launching a malicious payload.
Sigma
