Cross-source coverage

T1564.006 / ATT&CK

Hide Artifacts: Run Virtual Instance

6 rules across 4 sources.

From MITRE ATT&CK 19.2

Adversaries may carry out malicious operations using a virtual instance to avoid detection. A wide variety of virtualization technologies exist that allow for the emulation of a computer or computing environment. By running malicious code inside of a virtual instance, adversaries can hide artifacts associated with their behavior from security tools that are unable to monitor activity inside the virtual instance. Additionally, depending on the virtual networking implementation (ex: bridged adapter), network traffic generated by the virtual instance can be difficult to trace back to the compromised host as the IP address and hostname might not match known values.

Adversaries may utilize native support for virtualization (ex: Hyper-V), deploy lightweight emulators (ex: QEMU), or drop the necessary files to run a virtual instance (ex: VirtualBox binaries). After running a virtual instance, adversaries may create a shared folder between the guest and host with permissions that enable the virtual instance to interact with the host file system.

Threat actors may also leverage temporary virtualized environments such as the Windows Sandbox, which supports the use of .wsb configuration files for defining execution parameters. For example, the <MappedFolder> property supports the creation of a shared folder, while the <LogonCommand> property allows the specification of a payload.

In VMWare environments, adversaries may leverage the vCenter console to create new virtual machines. However, they may also create virtual machines directly on ESXi servers by running a valid .vmx file with the /bin/vmx utility. Adding this command to /etc/rc.local.d/local.sh (i.e., RC Scripts) will cause the VM to persistently restart. Creating a VM this way prevents it from appearing in the vCenter console or in the output to the vim-cmd vmsvc/getallvms command on the ESXi server, thereby hiding it from typical administrative activities.

Tactics
Stealth
Platforms
ESXi · Linux · macOS · Windows
Telemetry
WinEventLog:SysmonWinEventLog:SystemWinEventLog:Securityauditd:SYSCALLmacos:unifiedlogesxi:hostdesxi:vmkernel

How MITRE says to detect it DET0321

Detection Strategy for Hidden Virtual Instance Execution

Windows Analytic 0909

Unusual execution of virtualization binaries (VBoxManage.exe, vmware-vmx.exe, vmwp.exe) with headless or suppressed notification arguments. Registry and service modifications linked to virtualization installs. Defender view: anomalies in process creation, service metadata, and registry writes tied to enabling hidden VMs.

  • WinEventLog:Sysmon EventCode=1
  • WinEventLog:System EventCode=7045
  • WinEventLog:Security EventCode=4657

Linux Analytic 0910

Execution of QEMU, KVM, or VirtualBox processes with unusual flags (e.g., '-nographic', '-snapshot'). File creation of VM images in atypical directories. Defender view: monitoring audit logs for process executions and file modifications linked to hidden virtualization.

  • auditd:SYSCALL execve calls for qemu-system*, kvm, or VBoxHeadless
  • auditd:SYSCALL File creations of *.qcow2, *.vdi, *.vmdk outside standard VM directories

macOS Analytic 0911

Execution of virtualization binaries (Parallels, VMware Fusion, VirtualBox) with arguments to hide UI. File monitoring for plist modifications indicating hidden virtualization behavior. Defender perspective: tracking process lineage and file modifications in system configs.

  • macos:unifiedlog Process execution for VBoxHeadless, prl_vm_app, vmware-vmx
  • macos:unifiedlog Plist modifications containing virtualization run configurations

ESXi Analytic 0912

Direct execution of /bin/vmx or presence of rogue.vmx files not registered in vCenter inventory. Defender perspective: anomalous commands in shell history, edits to rc.local.d/local.sh for persistence.

  • esxi:hostd Execution of '/bin/vmx' or modifications to '/etc/rc.local.d/local.sh'
  • esxi:vmkernel VMX startup messages without associated vCenter inventory records

View on attack.mitre.org ↗

SigmaHQ/sigma

2 rules
Detection Severity Format
Suspicious Hyper-V Cmdlets Medium Sigma
Virtualbox Driver Installation or Starting of VMs Low Sigma

splunk/security_content

2 rules
Detection Severity Format
Windows ConHost with Headless Argument Undefined SPL
Windows Suspicious QEMU Execution Undefined SPL

elastic/detection-rules

1 rule
Detection Severity Format
Windows Sandbox with Sensitive Configuration Medium Elastic TOML

elastic/protections-artifacts

1 rule
Detection Severity Format
Suspicious Windows Sandbox Execution Undefined Elastic TOML

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.