{"id":"5fc297ae-25b6-488a-8f25-cc12ac29b744","title":"Potentially Suspicious Usage Of Qemu","description":"Detects potentially suspicious execution of the Qemu utility in a Windows environment.\nThreat actors have leveraged this utility and this technique for achieving network access as reported by Kaspersky.\n","author":"Muhammad Faisal (@faisalusuf), Hunter Juhan (@threatHNTR)","status":"test","level":"medium","date":"2024-06-03","modified":"","tags":["attack.command-and-control","attack.t1090","attack.t1572"],"technique_ids":["T1090","T1572"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://securelist.com/network-tunneling-with-qemu/111803/","https://www.qemu.org/docs/master/system/invocation.html#hxtool-5"],"source_path":"rules/windows/process_creation/proc_creation_win_qemu_suspicious_execution.yml","source_sha256":"672d7bddced701dabaa009b794a552bdd54bba934ae1560e1c99bde199c9d1a0","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_qemu_suspicious_execution.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potentially Suspicious Usage Of Qemu\nid: 5fc297ae-25b6-488a-8f25-cc12ac29b744\nstatus: test\ndescription: |\n    Detects potentially suspicious execution of the Qemu utility in a Windows environment.\n    Threat actors have leveraged this utility and this technique for achieving network access as reported by Kaspersky.\nreferences:\n    - https://securelist.com/network-tunneling-with-qemu/111803/\n    - https://www.qemu.org/docs/master/system/invocation.html#hxtool-5\nauthor: Muhammad Faisal (@faisalusuf), Hunter Juhan (@threatHNTR)\ndate: 2024-06-03\ntags:\n    - attack.command-and-control\n    - attack.t1090\n    - attack.t1572\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        CommandLine|contains:\n            - '-m 1M' # VM with just 1MB of ram is insufficient this is a suspicious flag\n            - '-m 2M'\n            - '-m 3M'\n        CommandLine|contains|all:\n            - 'restrict=off'\n            - '-netdev '\n            - 'connect='\n            - '-nographic' # This is also a key detection no one invoke without UI from console usually its a flag.\n    filter_main_normal_usecase:\n        CommandLine|contains:\n            - ' -cdrom ' # Normal usage cases\n            - ' type=virt '\n            - ' -blockdev '\n    condition: selection and not 1 of filter_main_*\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1090","id":"T1090","name":"Proxy","page":"techniques/enterprise/T1090/"},{"key":"enterprise/T1572","id":"T1572","name":"Protocol Tunneling","page":"techniques/enterprise/T1572/"}],"data_path":"data/detection-rules/5fc297ae-25b6-488a-8f25-cc12ac29b744.json","kind":"sigma"}