Suspicious VBoxDrvInst.exe Parameters (via process_creation)

title: Suspicious VBoxDrvInst.exe Parameters (via process_creation)
id: 398f8e14-ce7e-5ae1-8045-bdb049d90cb2
status: stable
description: This rule detects VBoxDrvInst.exe run with parameters allowing processing INF file. This enables to create values in the registry and install drivers. For example one could use this method to obtain persistence via modifying one of Run or RunOnce registry keys
references:
    - https://attack.mitre.org/techniques/T1112/
    - https://github.com/LOLBAS-Project/LOLBAS/blob/4db780e0f0b2e2bb8cb1fa13e09196da9b9f1834/yml/LOLUtilz/OtherBinaries/VBoxDrvInst.yml
    - https://twitter.com/pabraeken/status/993497996179492864
author: Huntrule Team
date: 2026-02-07
tags:
    - attack.persistence
    - attack.defense-impairment
    - attack.t1112
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\VBoxDrvInst.exe'
        CommandLine|contains|all:
            - 'driver'
            - 'executeinf'
    condition: selection
falsepositives:
    - Unknown
level: medium