{"id":"bab049ca-7471-4828-9024-38279a4c04da","title":"Virtualbox Driver Installation or Starting of VMs","description":"Adversaries can carry out malicious operations using a virtual instance to avoid detection. This rule is built to detect the registration of the Virtualbox driver or start of a Virtualbox VM.","author":"Janantha Marasinghe","status":"test","level":"low","date":"2020-09-26","modified":"2025-07-29","tags":["attack.stealth","attack.t1564.006","attack.t1564"],"technique_ids":["T1564","T1564.006"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["This may have false positives on hosts where Virtualbox is legitimately being used for operations"],"references":["https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/","https://threatpost.com/maze-ransomware-ragnar-locker-virtual-machine/159350/"],"source_path":"rules/windows/process_creation/proc_creation_win_virtualbox_execution.yml","source_sha256":"5d9d1a21a36c7749091be3de5772b2e52879f1aa0fe6fa6f4d528fe2ae986bc7","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_virtualbox_execution.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Virtualbox Driver Installation or Starting of VMs\nid: bab049ca-7471-4828-9024-38279a4c04da\nstatus: test\ndescription: Adversaries can carry out malicious operations using a virtual instance to avoid detection. This rule is built to detect the registration of the Virtualbox driver or start of a Virtualbox VM.\nreferences:\n    - https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/\n    - https://threatpost.com/maze-ransomware-ragnar-locker-virtual-machine/159350/\nauthor: Janantha Marasinghe\ndate: 2020-09-26\nmodified: 2025-07-29\ntags:\n    - attack.stealth\n    - attack.t1564.006\n    - attack.t1564\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_1:\n        CommandLine|contains:\n            - 'VBoxRT.dll,RTR3Init'\n            - 'VBoxC.dll'\n            - 'VBoxDrv.sys'\n    selection_2:\n        CommandLine|contains:\n            - 'startvm'\n            - 'controlvm'\n    condition: 1 of selection_*\nfalsepositives:\n    - This may have false positives on hosts where Virtualbox is legitimately being used for operations\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1564","id":"T1564","name":"Hide Artifacts","page":"techniques/enterprise/T1564/"},{"key":"enterprise/T1564.006","id":"T1564.006","name":"Run Virtual Instance","page":"techniques/enterprise/T1564.006/"}],"data_path":"data/detection-rules/bab049ca-7471-4828-9024-38279a4c04da.json","kind":"sigma"}