AN0909
Analytic 0909
Windows
Unusual execution of virtualization binaries (VBoxManage.exe, vmware-vmx.exe, vmwp.exe) with headless or suppressed notification arguments. Registry and service modifications linked to virtualization installs. Defender view: anomalies in process creation, service metadata, and registry writes tied to enabling hidden VMs.
WinEventLog:Sysmon
EventCode=1
WinEventLog:System
EventCode=7045
WinEventLog:Security
EventCode=4657
[VirtualizationBinaryWhitelist]
Exclude known administrative VM software usage in enterprise environments.
[TimeWindow]
Correlate registry and service modifications with VM process starts within a narrow time frame.
AN0910
Analytic 0910
Linux
Execution of QEMU, KVM, or VirtualBox processes with unusual flags (e.g., '-nographic', '-snapshot'). File creation of VM images in atypical directories. Defender view: monitoring audit logs for process executions and file modifications linked to hidden virtualization.
auditd:SYSCALL
execve calls for qemu-system*, kvm, or VBoxHeadless
auditd:SYSCALL
File creations of *.qcow2, *.vdi, *.vmdk outside standard VM directories
[ImageDirectoryWhitelist]
Legitimate VM image storage paths to reduce false positives.
[UserContext]
Correlate suspicious VM execution with non-admin or service accounts.
AN0911
Analytic 0911
macOS
Execution of virtualization binaries (Parallels, VMware Fusion, VirtualBox) with arguments to hide UI. File monitoring for plist modifications indicating hidden virtualization behavior. Defender perspective: tracking process lineage and file modifications in system configs.
macos:unifiedlog
Process execution for VBoxHeadless, prl_vm_app, vmware-vmx
macos:unifiedlog
Plist modifications containing virtualization run configurations
[PlistKeyScope]
Focus monitoring on UI suppression or VM auto-run keys.
AN0912
Analytic 0912
ESXi
Direct execution of /bin/vmx or presence of rogue .vmx files not registered in vCenter inventory. Defender perspective: anomalous commands in shell history, edits to rc.local.d/local.sh for persistence.
esxi:hostd
Execution of '/bin/vmx' or modifications to '/etc/rc.local.d/local.sh'
esxi:vmkernel
VMX startup messages without associated vCenter inventory records
[VMInventorySync]
Cross-verify running VMs with vCenter inventory for rogue instances.