PowerShell Virtualization Environment Discovery via WMI and Win32/ACPI Queries

title: PowerShell Virtualization Environment Discovery via WMI and Win32/ACPI Queries
id: 978d0141-e7b7-4297-b210-dd56bbab5947
status: test
description: This rule flags PowerShell script block activity that queries virtualization-related system information using WMI. Attackers often use these checks to determine whether they are running in a virtualized or analysis/sandbox environment and then adjust behavior to evade detection. It relies on Windows PowerShell Script Block Logging telemetry and matches script content containing WMI cmdlets alongside specific WMI classes related to computer system and ACPI thermal zone temperature.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1497.001/T1497.001.md
  - https://techgenix.com/malicious-powershell-scripts-evade-detection/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_detect_vm_env.yml
author: frack113, Duc.Le-GTSC, Huntrule Team
date: 2021-08-03
modified: 2022-03-03
tags:
  - attack.discovery
  - attack.stealth
  - attack.t1497.001
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_action:
    ScriptBlockText|contains:
      - Get-WmiObject
      - gwmi
  selection_module:
    ScriptBlockText|contains:
      - MSAcpi_ThermalZoneTemperature
      - Win32_ComputerSystem
  condition: all of selection*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: d93129cd-1ee0-479f-bc03-ca6f129882e3
    type: derived