Skip to content

Hide Navigation Hide TOC

Detect Virtualbox Driver Installation OR Starting Of VMs (bab049ca-7471-4828-9024-38279a4c04da)

Adversaries can carry out malicious operations using a virtual instance to avoid detection. This rule is built to detect the registration of the Virtualbox driver or start of a Virtualbox VM.

Cluster A Galaxy A Cluster B Galaxy B Level
Detect Virtualbox Driver Installation OR Starting Of VMs (bab049ca-7471-4828-9024-38279a4c04da) Sigma-Rules Hide Artifacts - T1564 (22905430-4901-4c2a-84f6-98243cb173f8) Attack Pattern 1
Detect Virtualbox Driver Installation OR Starting Of VMs (bab049ca-7471-4828-9024-38279a4c04da) Sigma-Rules Run Virtual Instance - T1564.006 (b5327dd1-6bf9-4785-a199-25bcbd1f4a9d) Attack Pattern 1
Hide Artifacts - T1564 (22905430-4901-4c2a-84f6-98243cb173f8) Attack Pattern Run Virtual Instance - T1564.006 (b5327dd1-6bf9-4785-a199-25bcbd1f4a9d) Attack Pattern 2