Adversaries may carry out malicious operations using a virtual instance to avoid detection. A wide variety of virtualization technologies exist that allow for the emulation of a computer or computing environment. By running malicious code inside of a virtual instance, adversaries can hide artifacts associated with their behavior from security tools that are unable to monitor activity inside the virtual instance.[1] Additionally, depending on the virtual networking implementation (ex: bridged adapter), network traffic generated by the virtual instance can be difficult to trace back to the compromised host as the IP address and hostname might not match known values.[2]
3 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Has used VirtualBox and a stripped Windows XP virtual machine to run itself. The use of a shared folder specified in the configuration enables Ragnar Locker to encrypt files on the host operating system, including files on any mapped drives.1
Has used QEMU and VirtualBox to run a Tiny Core Linux virtual machine, which runs XMRig and makes connections to the C2 server for updates.1
Operators have used VirtualBox and a Windows 7 virtual machine to run the ransomware; the virtual machine's configuration file mapped the shared network drives of the target company, presumably so Maze can encrypt files on the shared drives as well as the local machine.1
All 3 software entries for this technique
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
AN0909 · Windows
Unusual execution of virtualization binaries (VBoxManage.exe, vmware-vmx.exe, vmwp.exe) with headless or suppressed notification arguments. Registry and service modifications linked to virtualization installs. Defender view: anomalies in process creation, service metadata, and registry writes tied to enabling hidden VMs.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| Service CreationDC0060 | WinEventLog:System | EventCode=7045 |
| Windows Registry Key ModificationDC0063 | WinEventLog:Security | EventCode=4657 |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| VirtualizationBinaryWhitelist | Exclude known administrative VM software usage in enterprise environments. |
| TimeWindow | Correlate registry and service modifications with VM process starts within a narrow time frame. |
AN0910 · Linux
Execution of QEMU, KVM, or VirtualBox processes with unusual flags (e.g., '-nographic', '-snapshot'). File creation of VM images in atypical directories. Defender view: monitoring audit logs for process executions and file modifications linked to hidden virtualization.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:SYSCALL | execve calls for qemu-system*, kvm, or VBoxHeadless |
| File CreationDC0039 | auditd:SYSCALL | File creations of *.qcow2, *.vdi, *.vmdk outside standard VM directories |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ImageDirectoryWhitelist | Legitimate VM image storage paths to reduce false positives. |
| UserContext | Correlate suspicious VM execution with non-admin or service accounts. |
AN0911 · macOS
Execution of virtualization binaries (Parallels, VMware Fusion, VirtualBox) with arguments to hide UI. File monitoring for plist modifications indicating hidden virtualization behavior. Defender perspective: tracking process lineage and file modifications in system configs.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:unifiedlog | Process execution for VBoxHeadless, prl_vm_app, vmware-vmx |
| File ModificationDC0061 | macos:unifiedlog | Plist modifications containing virtualization run configurations |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| PlistKeyScope | Focus monitoring on UI suppression or VM auto-run keys. |
AN0912 · ESXi
Direct execution of /bin/vmx or presence of rogue .vmx files not registered in vCenter inventory. Defender perspective: anomalous commands in shell history, edits to rc.local.d/local.sh for persistence.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Image MetadataDC0028 | esxi:vmkernel | VMX startup messages without associated vCenter inventory records |
| Command ExecutionDC0064 | esxi:hostd | Execution of '/bin/vmx' or modifications to '/etc/rc.local.d/local.sh' |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| VMInventorySync | Cross-verify running VMs with vCenter inventory for rogue instances. |
Periodically audit virtual machines for abnormalities. On ESXi servers, periodically compare the output of vim-cmd vmsvc/getallvms, which lists all VMs in vCenter, and escxli vm process list | grep Display, which lists all VMs hosted on ESXi.
Disable native virtualization technologies such as Hyper-V if not necessary within a given environment. Consider also disabling Windows Sandbox if it is not needed to test or debug applications.
Use application control to mitigate installation and use of unapproved virtualization software.
| # | Test | Platform | Executor | Elevation | Prereqs | Cleanup | Ref | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 01 | Register Portable Virtualbox | windows | cmd | — | 3 | Yes | ||||||||||||||||||||||||||
ransomware payloads via virtual machines (VM). Maze ransomware Input arguments
Attack command "C:\Program Files\Oracle\VirtualBox\VBoxSVC.exe" /reregserver regsvr32 /S "C:\Program Files\Oracle\VirtualBox\VboxC.dll" rundll32 "C:\Program Files\Oracle\VirtualBox\VBoxRT.dll,RTR3Init" sc create VBoxDRV binpath= "C:\Program Files\Oracle\VirtualBox\drivers\VboxDrv.sys" type= kernel start= auto error= normal displayname= PortableVBoxDRV sc start VBoxDRV Cleanup command sc stop VBoxDRV
sc delete VBoxDRV
regsvr32 /u /S "C:\Program Files\Oracle\VirtualBox\VboxC.dll"
msiexec /x "#{msi_file_path}" /qn
Prerequisite MSI file must exist on disk at specified location (#{msi_file_path}) Check if (Test-Path "#{msi_file_path}") {exit 0} else {exit 1}
Satisfy New-Item -Type Directory (split-path "#{msi_file_path}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1564.006/bin/Virtualbox_52.msi" -OutFile "#{msi_file_path}"
Prerequisite CAB file must exist on disk at specified location (#{cab_file_path}) Check if (Test-Path "#{cab_file_path}") {exit 0} else {exit 1}
Satisfy New-Item -Type Directory (split-path "#{cab_file_path}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1564.006/bin/common.cab" -OutFile "#{cab_file_path}"
Prerequisite Old version of Virtualbox must be installed Check if (Test-Path "C:\Program Files\Oracle\VirtualBox\VboxC.dll") {exit 0} else {exit 1}
Satisfy msiexec /i "#{msi_file_path}" /qn
GUIDf160d38e-c0ef-4332-9b48-9ef2d9813cc4 | ||||||||||||||||||||||||||||||||
| 02 | Create and start VirtualBox virtual machine | windows | cmd | — | 2 | Yes | ||||||||||||||||||||||||||
Create a simple VirtualBox VM and start up the machine Cleanup command stops and deletes the newly created VM and associated files https://www.virtualbox.org/manual/ch08.html#vboxmanage-startvm https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/ https://attack.mitre.org/techniques/T1564/006/ Input arguments
Attack command "#{vboxmanage_exe}" createvm --name "#{vm_name}" --register
"#{vboxmanage_exe}" modifyvm "#{vm_name}" --firmware efi
"#{vboxmanage_exe}" startvm "#{vm_name}"
Cleanup command "#{vboxmanage_exe}" controlvm "#{vm_name}" poweroff
"#{vboxmanage_exe}" unregistervm "#{vm_name}" --deletePrerequisite VirtualBox must exist on disk at specified locations (#{virtualbox_exe}) Check if (Test-Path "#{virtualbox_exe}") {exit 0} else {exit 1}
Satisfy New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
$wc = New-Object System.Net.WebClient
$wc.DownloadFile("#{virtualbox_download}","PathToAtomicsFolder\..\ExternalPayloads\#{virtualbox_installer}")
start-process -FilePath "PathToAtomicsFolder\..\ExternalPayloads\#{virtualbox_installer}" -ArgumentList "--silent" -Wait
Prerequisite VBoxManage must exist on disk at specified locations (#{vboxmanage_exe}) Check if (Test-Path "#{vboxmanage_exe}") {exit 0} else {exit 1}
Satisfy $wc = New-Object System.Net.WebClient
$wc.DownloadFile("#{virtualbox_download}","PathToAtomicsFolder\..\ExternalPayloads\#{virtualbox_installer}")
start-process -FilePath "PathToAtomicsFolder\..\ExternalPayloads\#{virtualbox_installer}" -ArgumentList "--silent" -Wait
GUID72c9b29a-943d-4a53-b8bd-c13664c84f53 | ||||||||||||||||||||||||||||||||
| 03 | Create and start Hyper-V virtual machine | windows | PowerShell | Required | 1 | Yes | ||||||||||||||||||||||||||
Create a simple Hyper-V VM (Windows native hypervisor) and start up the machine Cleanup command stops and deletes the newly created VM https://docs.microsoft.com/en-us/virtualization/hyper-v-on-windows/quick-start/enable-hyper-v https://embracethered.com/blog/posts/2020/shadowbunny-virtual-machine-red-teaming-technique/ https://attack.mitre.org/techniques/T1564/006/ Input arguments
Attack command $VM = "#{vm_name}"
New-VM -Name $VM -Generation 2
Set-VMFirmware $VM -EnableSecureBoot Off
Start-VM $VMCleanup command Stop-VM $VM -Force Remove-VM $VM -Force Prerequisite Hyper-V must be enabled on the system Checks whether Hyper-V is enabled. If not, enables Hyper-V and forces a required restart Check if ((Get-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V).State = "Enabled") {exit 0} else {exit 1}
Satisfy Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V -All -Force GUID80d0bdc8-00e7-4a0e-b584-66fdaa3255d1 | ||||||||||||||||||||||||||||||||
Tests from Atomic Red Team (MIT licence) · technique definition
4 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.
Loading detections...
| Select | Title | Description | Category | Status | Event | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|