Suspicious Hyper-V PowerShell Cmdlets Usage on Windows

Alerts when PowerShell script blocks use Hyper-V VM creation or start cmdlets (New-VM, Set-VMFirmware, Start-VM).

FreeUnreviewedSigmamediumv1

suspicious-hyper-v-powershell-cmdlets-usage-on-windows-42d36aa1

title: Suspicious Hyper-V PowerShell Cmdlets Usage on Windows
id: 2db03df6-5e08-4fef-a30d-d10af18fbba8
status: test
description: This rule flags PowerShell script blocks that include Hyper-V cmdlets associated with creating, configuring firmware, or starting virtual machines (New-VM, Set-VMFirmware, Start-VM). Such activity can be used to rapidly establish virtualized environments for stealthy operations. It relies on PowerShell Script Block Logging telemetry to match these cmdlet strings within script block text.
references:
  - https://learn.microsoft.com/en-us/virtualization/hyper-v-on-windows/quick-start/enable-hyper-v
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.006/T1564.006.md#atomic-test-3---create-and-start-hyper-v-virtual-machine
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_hyper_v_condlet.yml
author: frack113, Huntrule Team
date: 2022-04-09
tags:
  - attack.stealth
  - attack.t1564.006
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains:
      - New-VM
      - Set-VMFirmware
      - Start-VM
  condition: selection
falsepositives:
  - Legitimate PowerShell scripts
level: medium
license: DRL-1.1
related:
  - id: 42d36aa1-3240-4db0-8257-e0118dcdd9cd
    type: derived

What it detects

This rule flags PowerShell script blocks that include Hyper-V cmdlets associated with creating, configuring firmware, or starting virtual machines (New-VM, Set-VMFirmware, Start-VM). Such activity can be used to rapidly establish virtualized environments for stealthy operations. It relies on PowerShell Script Block Logging telemetry to match these cmdlet strings within script block text.

Known false positives

Legitimate PowerShell scripts

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.