PowerShell Virtualization Environment Discovery via WMI in ScriptBlockLogging (Windows)
Identifies PowerShell WMI queries for Win32 computer system and ACPI thermal data used to check virtualization environments.
- Product
- windows
- Category
- ps_script
- Author
- frack113, Duc.Le-GTSC (SigmaHQ), DRL 1.1
- Published
- 2021-08-03
- Updated
- 2026-07-31
ATT&CK techniques
Defense Evasion → DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags PowerShell script blocks that contain WMI calls (Get-WmiObject/gwmi) together with queries for virtualization- and system-environment related WMI classes. Adversaries use these checks to identify virtual machine or sandbox contexts and alter behavior to evade analysis. The detection relies on Windows PowerShell Script Block Logging telemetry capturing the invoked WMI cmdlets and referenced WMI class names.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1497.001/T1497.001.md
- techgenix.comhttps://techgenix.com/malicious-powershell-scripts-evade-detection/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_detect_vm_env.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: PowerShell Virtualization Environment Discovery via WMI in ScriptBlockLogging (Windows)
id: 978d0141-e7b7-4297-b210-dd56bbab5947
status: test
description: This rule flags PowerShell script blocks that contain WMI calls (Get-WmiObject/gwmi) together with queries for virtualization- and system-environment related WMI classes. Adversaries use these checks to identify virtual machine or sandbox contexts and alter behavior to evade analysis. The detection relies on Windows PowerShell Script Block Logging telemetry capturing the invoked WMI cmdlets and referenced WMI class names.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1497.001/T1497.001.md
- https://techgenix.com/malicious-powershell-scripts-evade-detection/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_detect_vm_env.yml
author: frack113, Duc.Le-GTSC, Huntrule Team
date: 2021-08-03
modified: 2022-03-03
tags:
- attack.discovery
- attack.stealth
- attack.t1497.001
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection_action:
ScriptBlockText|contains:
- Get-WmiObject
- gwmi
selection_module:
ScriptBlockText|contains:
- MSAcpi_ThermalZoneTemperature
- Win32_ComputerSystem
condition: all of selection*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: d93129cd-1ee0-479f-bc03-ca6f129882e3
type: derived