XWorm Webcam.dll load in RegSvcs.exe with VM-check WMI activity
Correlates a Webcam.dll image load with VM-detection commands (such as queries for VirtualBox, VMware, vbox, vmtoolsd, Win32_ComputerSystem, or Win32_BIOS) executed by the same RegSvcs.exe process, which is characteristic of XWorm malware behavior.
Microsoft Sentinel (KQL)
