Unusual execution of virtualization binaries (VBoxManage.exe, vmware-vmx.exe, vmwp.exe) with headless or suppressed notification arguments. Registry and service modifications linked to virtualization installs. Defender view: anomalies in process creation, service metadata, and registry writes tied to enabling hidden VMs.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | WinEventLog:Sysmon | EventCode=1 |
| Service Creation (DC0060) | WinEventLog:System | EventCode=7045 |
| Windows Registry Key Modification (DC0063) | WinEventLog:Security | EventCode=4657 |
| Field | Description |
|---|---|
| VirtualizationBinaryWhitelist | Exclude known administrative VM software usage in enterprise environments. |
| TimeWindow | Correlate registry and service modifications with VM process starts within a narrow time frame. |
Execution of QEMU, KVM, or VirtualBox processes with unusual flags (e.g., '-nographic', '-snapshot'). File creation of VM images in atypical directories. Defender view: monitoring audit logs for process executions and file modifications linked to hidden virtualization.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | auditd:SYSCALL | execve calls for qemu-system*, kvm, or VBoxHeadless |
| File Creation (DC0039) | auditd:SYSCALL | File creations of *.qcow2, *.vdi, *.vmdk outside standard VM directories |
| Field | Description |
|---|---|
| ImageDirectoryWhitelist | Legitimate VM image storage paths to reduce false positives. |
| UserContext | Correlate suspicious VM execution with non-admin or service accounts. |
Execution of virtualization binaries (Parallels, VMware Fusion, VirtualBox) with arguments to hide UI. File monitoring for plist modifications indicating hidden virtualization behavior. Defender perspective: tracking process lineage and file modifications in system configs.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | macos:unifiedlog | Process execution for VBoxHeadless, prl_vm_app, vmware-vmx |
| File Modification (DC0061) | macos:unifiedlog | Plist modifications containing virtualization run configurations |
| Field | Description |
|---|---|
| PlistKeyScope | Focus monitoring on UI suppression or VM auto-run keys. |
Direct execution of /bin/vmx or presence of rogue .vmx files not registered in vCenter inventory. Defender perspective: anomalous commands in shell history, edits to rc.local.d/local.sh for persistence.
| Data Component | Name | Channel |
|---|---|---|
| Command Execution (DC0064) | esxi:hostd | Execution of '/bin/vmx' or modifications to '/etc/rc.local.d/local.sh' |
| Image Metadata (DC0028) | esxi:vmkernel | VMX startup messages without associated vCenter inventory records |
| Field | Description |
|---|---|
| VMInventorySync | Cross-verify running VMs with vCenter inventory for rogue instances. |