attack.t1564.006 | Detection.FYI

Suspicious Hyper-V Cmdlets

Apr 28, 2026 · attack.stealth attack.t1564.006 ·
Share on:

Adversaries may carry out malicious operations using a virtual instance to avoid detection

Read More
Virtualbox Driver Installation or Starting of VMs

Apr 28, 2026 · attack.stealth attack.t1564.006 attack.t1564 ·
Share on:

Adversaries can carry out malicious operations using a virtual instance to avoid detection. This rule is built to detect the registration of the Virtualbox driver or start of a Virtualbox VM.

Read More