Sigma rule: Potentially Suspicious Usage Of Qemu

Rule

Title

Potentially Suspicious Usage Of Qemu

Status

test

Level

medium

Author

Muhammad Faisal (@faisalusuf), Hunter Juhan (@threatHNTR)

Date

2024-06-03

File

rules/windows/process_creation/proc_creation_win_qemu_suspicious_execution.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects potentially suspicious execution of the Qemu utility in a Windows environment.
Threat actors have leveraged this utility and this technique for achieving network access as reported by Kaspersky.

Log source

product

windows

category

process_creation

Detection

selection:
    CommandLine|contains:
        - '-m 1M' # VM with just 1MB of ram is insufficient this is a suspicious flag
        - '-m 2M'
        - '-m 3M'
    CommandLine|contains|all:
        - 'restrict=off'
        - '-netdev '
        - 'connect='
        - '-nographic' # This is also a key detection no one invoke without UI from console usually its a flag.
filter_main_normal_usecase:
    CommandLine|contains:
        - ' -cdrom ' # Normal usage cases
        - ' type=virt '
        - ' -blockdev '
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.command-and-control
• attack.t1090
• attack.t1572

MITRE ATT&CK ids this rule names

• T1090
• T1572

References

• https://securelist.com/network-tunneling-with-qemu/111803/
• https://www.qemu.org/docs/master/system/invocation.html#hxtool-5

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_qemu_suspicious_execution.yml