WScript/CScript WMI Query for OS InstallDate (Sandbox Evasion)

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•3

Detects the use of WScript or CScript to query the Win32_OperatingSystem WMI class for the InstallDate property. This behavior is commonly used by malware to identify the system installation time, which can serve as a simple heuristic for sandbox evasion or environmental keying.