PowerShell Hidden System Discovery via WMI (EtherRAT)

Ethan Andrews@eandrews

•updated Jun 16, 2026•9•0•8

Detects PowerShell executing specific WMI queries targeted at identifying video controllers or domain membership in a hidden, non-interactive window. This behavior is used by EtherRAT for sandbox evasion and system profiling post-compromise.