Session 0 vs Interactive Session Check via GetUserObjectInformationW
Detects usage of the Windows API function GetUserObjectInformationW to inspect the current window station for specific strings, such as 'Service-0x'. This technique is often used by malware for environmental awareness, specifically to detect if it is running within a virtual machine or analysis sandbox by checking window station object attributes.
Sigma
