Non-Standard Process WMI VM Artifact Query Evasion T1497.001

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•2

Detects high-frequency non-standard process executions involving WMI queries that specifically target virtual environment artifacts (e.g., VMware, VirtualBox, VBoxService, QEMU). This behavior is characteristic of sandbox or virtualization evasion, where malware attempts to identify if it is running in a virtualized or analysis environment to potentially alter its behavior.