LoFP / this may have false positives on hosts where virtualbox is legitimately being used for operations

Techniques

• t1564
• t1564.006

Sample rules

Virtualbox Driver Installation or Starting of VMs

• source: sigma
• technicques:
  • t1564
  • t1564.006

Description

Adversaries can carry out malicious operations using a virtual instance to avoid detection. This rule is built to detect the registration of the Virtualbox driver or start of a Virtualbox VM.

Detection logic

condition: 1 of selection_*
selection_1:
  CommandLine|contains:
  - VBoxRT.dll,RTR3Init
  - VBoxC.dll
  - VBoxDrv.sys
selection_2:
  CommandLine|contains:
  - startvm
  - controlvm