The SANS Internet Storm Center shares an excellent awareness of how Powershell which provides low-level API interaction with O/S can be manipulated when permission is given by users in one-click or other attack methods

Powershell is a great language that can interact at a low-level with Microsoft Windows. While hunting, I found a nice piece of Powershell code. After some deeper checks, it appeared that the code was not brand new but it remains interesting to learn how a malware infects (or not) a computer and tries to collect interesting data from the victim.  Usually, a malware will avoid to install itself on a virtualized environment (an automated sandbox or a security analyst’s lab). A common way to detect a virtualized environment is to check BIOS values. Powershell can use query lot of operating system information through WMI