Windows: Suspicious Qemu execution with low-memory and network-tunneling flags

ATT&CK techniques

C2

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1090Proxy
- T1572Protocol Tunneling
Exfiltration
Impact

What it detects

This rule flags Qemu process creation on Windows when the command line includes low-memory VM settings and key network-related options such as -netdev with connect= and nographic. These parameters can indicate attempts to use Qemu for non-interactive operation and network access, which is commonly associated with attacker-controlled tunneling or proxy behavior. It relies on Windows process creation telemetry, matching specific substrings within the process command line.

Reporting behind it

Related detections9 linkedT1090 — drag to rearrange

Malicious QEMU Covert Network Tunnel via User-Mode netdev Socket (via process_creation)

Malicious Tunneling Tool Execution on Linux Host (via process_creation)

Suspicious Chisel Reverse Tunnel Execution by UAT-9686

Windows Network Connections to LocaltoNet/Localtonet Tunneling Subdomains

Linux: Network connections initiated to LocaltoNet tunneling subdomains

Windows: Detect cloudflared tunnel cleanup command execution

Windows Process Creation: cloudflared Tunnel Execution with Config and Credentials Flags

Linux network connections to ngrok tunneling endpoints

Windows Executable Initiating Connections to ngrok Tunnel Domains

Windows: Suspicious Qemu execution with low-memory and network-tunneling flags

Pivot detection · T1090 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-suspicious-qemu-execution-with-low-memory-and-network-tunneling-flags-5fc297ae

title: "Windows: Suspicious Qemu execution with low-memory and network-tunneling flags"
id: 58d89fe2-6ad3-4859-976a-5b80e9f7a8aa
status: test
description: This rule flags Qemu process creation on Windows when the command line includes low-memory VM settings and key network-related options such as -netdev with connect= and nographic. These parameters can indicate attempts to use Qemu for non-interactive operation and network access, which is commonly associated with attacker-controlled tunneling or proxy behavior. It relies on Windows process creation telemetry, matching specific substrings within the process command line.
references:
  - https://securelist.com/network-tunneling-with-qemu/111803/
  - https://www.qemu.org/docs/master/system/invocation.html#hxtool-5
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_qemu_suspicious_execution.yml
author: Muhammad Faisal (@faisalusuf), Hunter Juhan (@threatHNTR), Huntrule Team
date: 2024-06-03
tags:
  - attack.command-and-control
  - attack.t1090
  - attack.t1572
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - -m 1M
      - -m 2M
      - -m 3M
    CommandLine|contains|all:
      - restrict=off
      - "-netdev "
      - connect=
      - -nographic
  filter_main_normal_usecase:
    CommandLine|contains:
      - " -cdrom "
      - " type=virt "
      - " -blockdev "
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 5fc297ae-25b6-488a-8f25-cc12ac29b744
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL