Detection rules › Sigma

Virtualbox Driver Installation or Starting of VMs

Severity
low
Author
Janantha Marasinghe
Source
upstream

Adversaries can carry out malicious operations using a virtual instance to avoid detection. This rule is built to detect the registration of the Virtualbox driver or start of a Virtualbox VM.

MITRE ATT&CK coverage

TacticTechniques
Defense EvasionT1564 Hide Artifacts, T1564.006 Hide Artifacts: Run Virtual Instance

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation
Security-Auditing4688A new process has been created.

Stages and Predicates

Stage 1: 1 of selection_1

or:
CommandLine|contains: VBoxC.dll
CommandLine|contains: VBoxDrv.sys
CommandLine|contains: 'VBoxRT.dll,RTR3Init'

Stage 2: 1 of selection_2

or:
CommandLine|contains: controlvm
CommandLine|contains: startvm

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • VBoxC.dll
  • VBoxDrv.sys
  • VBoxRT.dll,RTR3Init
  • controlvm
  • startvm