Windows VirtualBox Driver Registration or VM Startup via Process Command Line

Alerts on Windows processes whose command lines reference VirtualBox driver registration or VM start/control actions.

FreeUnreviewedSigmalowv1

windows-virtualbox-driver-registration-or-vm-startup-via-process-command-line-bab049ca

title: Windows VirtualBox Driver Registration or VM Startup via Process Command Line
id: 022d40a0-6d7c-4835-b1e6-9275090b2ab6
status: test
description: This rule flags Windows process command lines that indicate VirtualBox driver registration (DLL and driver initialization strings) or the launching/control of a VirtualBox VM (startvm/controlvm). Such activity matters because attackers may use virtualization to run and stage operations while attempting to evade host-based monitoring. The detection relies on process creation telemetry and searches for specific substrings within the process command line.
references:
  - https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/
  - https://threatpost.com/maze-ransomware-ragnar-locker-virtual-machine/159350/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_virtualbox_execution.yml
author: Janantha Marasinghe, Huntrule Team
date: 2020-09-26
modified: 2025-07-29
tags:
  - attack.stealth
  - attack.t1564.006
  - attack.t1564
logsource:
  category: process_creation
  product: windows
detection:
  selection_1:
    CommandLine|contains:
      - VBoxRT.dll,RTR3Init
      - VBoxC.dll
      - VBoxDrv.sys
  selection_2:
    CommandLine|contains:
      - startvm
      - controlvm
  condition: 1 of selection_*
falsepositives:
  - This may have false positives on hosts where Virtualbox is legitimately being used for operations
level: low
license: DRL-1.1
related:
  - id: bab049ca-7471-4828-9024-38279a4c04da
    type: derived

What it detects

This rule flags Windows process command lines that indicate VirtualBox driver registration (DLL and driver initialization strings) or the launching/control of a VirtualBox VM (startvm/controlvm). Such activity matters because attackers may use virtualization to run and stage operations while attempting to evade host-based monitoring. The detection relies on process creation telemetry and searches for specific substrings within the process command line.

Known false positives

This may have false positives on hosts where Virtualbox is legitimately being used for operations

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.