Detect Virtualbox Driver Installation OR Starting Of VMs

 1title: Detect Virtualbox Driver Installation OR Starting Of VMs
 2id: bab049ca-7471-4828-9024-38279a4c04da
 3status: test
 4description: Adversaries can carry out malicious operations using a virtual instance to avoid detection. This rule is built to detect the registration of the Virtualbox driver or start of a Virtualbox VM.
 5references:
 6    - https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/
 7    - https://threatpost.com/maze-ransomware-ragnar-locker-virtual-machine/159350/
 8author: Janantha Marasinghe
 9date: 2020-09-26
10modified: 2022-07-14
11tags:
12    - attack.defense-evasion
13    - attack.t1564.006
14    - attack.t1564
15logsource:
16    category: process_creation
17    product: windows
18detection:
19    selection_1:
20        CommandLine|contains:
21            - 'VBoxRT.dll,RTR3Init'
22            - 'VBoxC.dll'
23            - 'VBoxDrv.sys'
24    selection_2:
25        CommandLine|contains:
26            - 'startvm'
27            - 'controlvm'
28    condition: 1 of selection_*
29fields:
30    - ComputerName
31    - User
32    - CommandLine
33    - ParentCommandLine
34falsepositives:
35    - This may have false positives on hosts where Virtualbox is legitimately being used for operations
36level: low

References

• Ragnar Locker ransomware deploys virtual machine to dodge security

  

  A new ransomware attack method takes defense evasion to a new level—deploying as a full virtual machine on each targeted device to hide the ransomware from view. In a recently detected attack, Ragn…

  
  Read More

• Maze Ransomware Adopts Ragnar Locker Virtual-Machine Approach

  

  Maze continues to adopt tactics from rival cybercrime gangs.

  
  Read More

Related rules

• PUA - System Informer Execution
• Potentially Suspicious Execution From Parent Process In Public Folder
• Suspicious Creation with Colorcpl
• Suspicious Executable File Creation
• Suspicious Hyper-V Cmdlets