Sigma rule: Virtualbox Driver Installation or Starting of VMs

Rule

Title

Virtualbox Driver Installation or Starting of VMs

Status

test

Level

low

Author

Janantha Marasinghe

Date

2020-09-26

Modified

2025-07-29

File

rules/windows/process_creation/proc_creation_win_virtualbox_execution.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Adversaries can carry out malicious operations using a virtual instance to avoid detection. This rule is built to detect the registration of the Virtualbox driver or start of a Virtualbox VM.

Log source

product

windows

category

process_creation

Detection

selection_1:
    CommandLine|contains:
        - 'VBoxRT.dll,RTR3Init'
        - 'VBoxC.dll'
        - 'VBoxDrv.sys'
selection_2:
    CommandLine|contains:
        - 'startvm'
        - 'controlvm'
condition: 1 of selection_*

False positives (as the rule lists them)

• This may have false positives on hosts where Virtualbox is legitimately being used for operations

Tags

• attack.stealth
• attack.t1564.006
• attack.t1564

MITRE ATT&CK ids this rule names

• T1564
• T1564.006

References

• https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/
• https://threatpost.com/maze-ransomware-ragnar-locker-virtual-machine/159350/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_virtualbox_execution.yml