During  the threat actors used a script that ran WMI queries to check if a VM or sandbox was running including VMWare and Virtualbox. The script would also call WMI to determine the number of cores allocated to the system; if less than two the script would stop execution.
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: During  the threat actors used a script that ran WMI queries to check if a VM or sandbox was running including VMWare and Virtualbox. The script would also call WMI to determine the number of cores allocated to the system; if less than two the script would stop execution. ### Response: T1497.001.