Suspicious Hyper-V Cmdlets (via ps_script)

title: Suspicious Hyper-V Cmdlets (via ps_script)
id: eccc6b1a-ff66-5aa7-9113-12b10ad52f30
status: stable
description: This rule detects threat actors may carry out hostile operations using a virtual instance to avoid detection
references:
    - https://attack.mitre.org/techniques/T1564/006/
    - https://learn.microsoft.com/en-us/virtualization/hyper-v-on-windows/quick-start/enable-hyper-v
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.006/T1564.006.md#atomic-test-3---create-and-start-hyper-v-virtual-machine
author: Huntrule Team
date: 2026-07-23
tags:
    - attack.stealth
    - attack.t1564.006
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection:
        ScriptBlockText|contains:
            - New-VM
            - Set-VMFirmware
            - Start-VM
    condition: selection
falsepositives:
    - Unknown
level: medium