Can wmic.exe be used for virtual machine detection?

Yes, wmic can query system information like total physical memory and number of logical processors by running `wmic /NAMESPACE:"\\root\\CIMV2" PATH Win32_ComputerSystem GET NumberOfLogicalProcessors,TotalPhysicalMemory /FORMAT:list`. Unusually low values may indicate a virtualized environment. This technique is covered in the virtual machine detection section of Study Notes of WMI Persistence using wmic.exe.