Windows VirtualBox Driver Registration or VM Startup via Process Command Line
Alerts on Windows processes whose command lines reference VirtualBox driver registration or VM start/control actions.
- Product
- windows
- Category
- process_creation
- Author
- Janantha Marasinghe (SigmaHQ), DRL 1.1
- Published
- 2020-09-26
- Updated
- 2026-07-30
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process command lines that indicate VirtualBox driver registration (DLL and driver initialization strings) or the launching/control of a VirtualBox VM (startvm/controlvm). Such activity matters because attackers may use virtualization to run and stage operations while attempting to evade host-based monitoring. The detection relies on process creation telemetry and searches for specific substrings within the process command line.
Reporting behind it
- news.sophos.comhttps://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/
- threatpost.comhttps://threatpost.com/maze-ransomware-ragnar-locker-virtual-machine/159350/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_virtualbox_execution.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows VirtualBox Driver Registration or VM Startup via Process Command Line
id: 022d40a0-6d7c-4835-b1e6-9275090b2ab6
status: test
description: This rule flags Windows process command lines that indicate VirtualBox driver registration (DLL and driver initialization strings) or the launching/control of a VirtualBox VM (startvm/controlvm). Such activity matters because attackers may use virtualization to run and stage operations while attempting to evade host-based monitoring. The detection relies on process creation telemetry and searches for specific substrings within the process command line.
references:
- https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/
- https://threatpost.com/maze-ransomware-ragnar-locker-virtual-machine/159350/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_virtualbox_execution.yml
author: Janantha Marasinghe, Huntrule Team
date: 2020-09-26
modified: 2025-07-29
tags:
- attack.stealth
- attack.t1564.006
- attack.t1564
logsource:
category: process_creation
product: windows
detection:
selection_1:
CommandLine|contains:
- VBoxRT.dll,RTR3Init
- VBoxC.dll
- VBoxDrv.sys
selection_2:
CommandLine|contains:
- startvm
- controlvm
condition: 1 of selection_*
falsepositives:
- This may have false positives on hosts where Virtualbox is legitimately being used for operations
level: low
license: DRL-1.1
related:
- id: bab049ca-7471-4828-9024-38279a4c04da
type: derived