T1564.006 Run Virtual Instance — Attack Simulation

Technique description

Adversaries may carry out malicious operations using a virtual instance to avoid detection. A wide variety of virtualization technologies exist that allow for the emulation of a computer or computing environment. By running malicious code inside of a virtual instance, adversaries can hide artifacts associated with their behavior from security tools that are unable to monitor activity inside the virtual instance. Additionally, depending on the…

At least one platform-compatible Atomic procedure is documented. Individual review, lab prerequisites, and validation remain required.

Official ATT&CK definition · Detection rules and anomaly models

Documented simulation candidates

• Create and start VirtualBox virtual machine
  windowsautomatedcommand_prompt

  Procedure 88b81702-a1c0-49a9-95b2-2dd53d755767; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.

• Register Portable Virtualbox
  windowsautomatedcommand_prompt

  Procedure c59f246a-34f8-4e4d-9276-c295ef9ba0dd; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.

• Create and start Hyper-V virtual machine
  windowsautomatedpowershell

  Procedure fb8d4d7e-f5a4-481c-8867-febf13f8b6d3; elevation required; cleanup present, not reviewed. Not executed or individually validated.