T1564.006 — Run Virtual Instance

Tactic: Stealth · Platforms: ESXi, Linux, macOS, Windows

Adversaries may carry out malicious operations using a virtual instance to avoid detection. A wide variety of virtualization technologies exist that allow for the emulation of a computer or computing environment. By running malicious code inside of a virtual instance, adversaries can hide…

Sub-technique of Hide Artifacts (T1564).

Sigma detection rules (4)

T1564.006 Hide Artifacts: Run Virtual Instance

title: "T1564.006 Hide Artifacts: Run Virtual Instance"
id: b23414b7-6767-468b-834e-ba5102de1486
description: 'Detection Strategy for Hidden Virtual Instance Execution via known virtualization CLI tooling (VBoxManage, VBoxHeadless, vmware-vmx, vmrun, qemu-system) launched with headless/no-GUI arguments. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: VirtualizationBinaryWhitelist, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1564/006
author: Shahrukh Khan
date: 2026-03-18
license: MIT
tags:
  - attack.stealth
  - attack.t1564.006

logsource:
  category: process_creation
  product: windows

detection:
  selection:
    Image|endswith:
      - '\VBoxManage.exe'
      - '\VBoxHeadless.exe'
      - '\vmware-vmx.exe'
      - '\vmrun.exe'
      - '\qemu-system-x86_64.exe'
      - '\qemu-system-i386.exe'
    CommandLine|contains:
      - 'startvm'
      - 'headless'
      - '-nographic'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - Legitimate virtualization/lab administration launching VMs headlessly or via automation scripts; tune with a VirtualizationBinaryWhitelist for known-good hosts.

level: medium

T1564.006 Hide Artifacts: Run Virtual Instance

title: "T1564.006 Hide Artifacts: Run Virtual Instance"
id: fd6124f0-e555-42f5-b217-f7088b9adbb7
description: 'Detection Strategy for Hidden Virtual Instance Execution. Removed the docker run --rm -it selector, which maps to container-based techniques rather than this technique''s described behavior of running an actual virtual machine to hide artifacts from host monitoring. Added VBoxManage/VBoxHeadless execution and shared-folder configuration flags (--type headless, sharedfolder add), since VirtualBox is explicitly cited in the technique description and was not covered at all. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ImageDirectoryWhitelist, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1564/006
author: Shahrukh Khan
date: 2026-02-28
license: MIT
tags:
  - attack.stealth
  - attack.t1564.006

logsource:
  category: process_creation
  product: linux

detection:
  selection_qemu:
    type: EXECVE
    a0|endswith: '/qemu-system-x86_64'
    a1|contains: '-nographic'
  selection_vbox_headless:
    type: EXECVE
    a0|endswith:
      - '/VBoxHeadless'
      - '/VBoxManage'
    a1|contains:
      - '--type'
      - 'headless'
      - 'startvm'
  selection_vbox_sharedfolder:
    type: EXECVE
    a0|endswith: '/VBoxManage'
    a1|contains: 'sharedfolder'

  condition: 1 of selection*

falsepositives:
  - Developers and CI pipelines routinely run ephemeral, headless VMs (VirtualBox or QEMU) for legitimate testing, and VirtualBox shared folders are used for routine dev-environment file exchange; tune ImageDirectoryWhitelist/UserContext to scope to unexpected users/hosts.

level: medium

T1564.006 Hide Artifacts: Run Virtual Instance

title: "T1564.006 Hide Artifacts: Run Virtual Instance"
id: d1e024ea-9aa8-4ca2-b8fc-4c58e76383d8
description: 'Detection Strategy for Hidden Virtual Instance Execution. (Retargeted to the file_change macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: PlistKeyScope.'
references:
  - https://attack.mitre.org/techniques/T1564/006
author: Shahrukh Khan
date: 2026-05-04
license: MIT
tags:
  - attack.stealth
  - attack.t1564.006

logsource:
  category: file_change
  product: macos

detection:
  selection:
    TargetFilename|endswith:
      - '.vmdk'
      - '.vdi'
      - '.vbox'

  condition: selection

falsepositives:
  - Legitimate developers or QA staff running VirtualBox or Parallels virtual machines for testing, which is common on engineering Macs.

level: low

T1564.006 Hide Artifacts: Run Virtual Instance

title: "T1564.006 Hide Artifacts: Run Virtual Instance"
id: c6e70913-bd4c-4938-9c11-6d8265db09e4
description: 'Detection Strategy for Hidden Virtual Instance Execution. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: VMInventorySync.'
references:
  - https://attack.mitre.org/techniques/T1564/006
author: Shahrukh Khan
date: 2026-06-10
license: MIT
tags:
  - attack.stealth
  - attack.t1564.006

logsource:
  product: esxi
  service: hostd

detection:
  selection:
    Message|contains:
      - 'UnregisterVM'
      - 'unregister'

  condition: selection

falsepositives:
  - Legitimate VM migration or storage vMotion workflows briefly unregister and re-register VMs; confirming this technique requires cross-referencing that the VM process remained powered on after unregistration, which is outside VMInventorySync visible in a single hostd.log line.

level: high

Related sub-techniques

Explore