Technique on mitre.org

T1564.006: Run Virtual Instance

Adversaries may carry out malicious operations using a virtual instance to avoid detection. A wide variety of virtualization technologies exist that allow for the emulation of a computer or computing environment. By running malicious code inside of a virtual instance, adversaries can hide artifacts associated with their behavior from security tools that are unable to monitor activity inside the virtual instance. Additionally, depending on the virtual networking implementation (ex: bridged adapter), network traffic generated by the virtual instance can be difficult to trace back to the compromised host as the IP address and hostname might not match known values.

Adversaries may utilize native support for virtualization (ex: Hyper-V) or drop the necessary files to run a virtual instance (ex: VirtualBox binaries). After running a virtual instance, adversaries may create a shared folder between the guest and host with permissions that enable the virtual instance to interact with the host file system.

Positive Technologies products that cover the technique

MaxPatrol SIEM knowledge base

vk_cloud: PT-CR-2291: VK_Cloud_Critical_VM_Operation: An untrusted user performed an operation on a critical virtual machine in VK Cloud. Attackers can gain access to critical virtual machines, manage them, and change their configuration, including network configuration. This allows them to interfere with the operation of critical virtual machines, disclose information stored on them, and prepare the environment for further attacks.

Detection

ID	DS0007	Data source and component	Image: Image Metadata	Description	Consider monitoring the size of virtual machines running on the system. Adversaries may create virtual images which are smaller than those of typical virtual machines. Network adapter information may also be helpful in detecting the use of virtual instances.

ID	DS0019	Data source and component	Service: Service Creation	Description	Monitor for newly constructed services/daemons that may carry out malicious operations using a virtual instance to avoid detection. Consider monitoring for new Windows Service, with respect to virtualization software.

ID	DS0024	Data source and component	Windows Registry: Windows Registry Key Modification	Description	Monitor for changes made to Windows Registry keys and/or values that may be the result of using a virtual instance to avoid detection. For example, if virtualization software is installed by the adversary the Registry may provide detection opportunities.

ID	DS0009	Data source and component	Process: Process Creation	Description	Monitor newly executed processes associated with running a virtual instance, such as those launched from binary files associated with common virtualization technologies (ex: VirtualBox, VMware, QEMU, Hyper-V).

ID	DS0022	Data source and component	File: File Creation	Description	Monitor for newly constructed files associated with running a virtual instance, such as binary files associated with common virtualization technologies (ex: VirtualBox, VMware, QEMU, Hyper-V).

ID	DS0017	Data source and component	Command: Command Execution	Description	Consider monitoring for commands and arguments that may be atypical for benign use of virtualization software. Usage of virtualization binaries or command-line arguments associated with running a silent installation may be especially suspect (ex. `-silent`, `-ignore-reboot`), as well as those associated with running a headless (in the background with no UI) virtual instance (ex. `VBoxManage startvm $VM --type headless`). Similarly, monitoring command line arguments which suppress notifications may highlight potentially malicious activity (ex. `VBoxManage.exe setextradata global GUI/SuppressMessages "all"`). Monitor for commands which enable hypervisors such as Hyper-V.

ID	Data source and component	Description
DS0007	Image: Image Metadata	Consider monitoring the size of virtual machines running on the system. Adversaries may create virtual images which are smaller than those of typical virtual machines. Network adapter information may also be helpful in detecting the use of virtual instances.
DS0019	Service: Service Creation	Monitor for newly constructed services/daemons that may carry out malicious operations using a virtual instance to avoid detection. Consider monitoring for new Windows Service, with respect to virtualization software.
DS0024	Windows Registry: Windows Registry Key Modification	Monitor for changes made to Windows Registry keys and/or values that may be the result of using a virtual instance to avoid detection. For example, if virtualization software is installed by the adversary the Registry may provide detection opportunities.
DS0009	Process: Process Creation	Monitor newly executed processes associated with running a virtual instance, such as those launched from binary files associated with common virtualization technologies (ex: VirtualBox, VMware, QEMU, Hyper-V).
DS0022	File: File Creation	Monitor for newly constructed files associated with running a virtual instance, such as binary files associated with common virtualization technologies (ex: VirtualBox, VMware, QEMU, Hyper-V).
DS0017	Command: Command Execution	Consider monitoring for commands and arguments that may be atypical for benign use of virtualization software. Usage of virtualization binaries or command-line arguments associated with running a silent installation may be especially suspect (ex. `-silent`, `-ignore-reboot`), as well as those associated with running a headless (in the background with no UI) virtual instance (ex. `VBoxManage startvm $VM --type headless`). Similarly, monitoring command line arguments which suppress notifications may highlight potentially malicious activity (ex. `VBoxManage.exe setextradata global GUI/SuppressMessages "all"`). Monitor for commands which enable hypervisors such as Hyper-V.

Mitigation

ID	M1042	Name	Disable or Remove Feature or Program	Description	Disable Hyper-V if not necessary within a given environment.

ID	M1038	Name	Execution Prevention	Description	Use application control to mitigate installation and use of unapproved virtualization software.

ID	Name	Description
M1042	Disable or Remove Feature or Program	Disable Hyper-V if not necessary within a given environment.
M1038	Execution Prevention	Use application control to mitigate installation and use of unapproved virtualization software.