Virtualbox Driver Installation or Starting of VMs

Title: Virtualbox Driver Installation or Starting of VMs
Status: test
Description:Adversaries can carry out malicious operations using a virtual instance to avoid detection. This rule is built to detect the registration of the Virtualbox driver or start of a Virtualbox VM.
References:
  -https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/
  -https://threatpost.com/maze-ransomware-ragnar-locker-virtual-machine/159350/
Author: Janantha Marasinghe
Date: 2020-09-26
modified:2025-07-29
Tags:

• -'attack.stealth'
• -'attack.t1564.006'
• -'attack.t1564'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_1:
    CommandLine|contains:
      -'VBoxRT.dll,RTR3Init'
      -'VBoxC.dll'
      -'VBoxDrv.sys'

  selection_2:
    CommandLine|contains:
      -'startvm'
      -'controlvm'

  condition:1 of selection_*
Falsepositives:
  -This may have false positives on hosts where Virtualbox is legitimately being used for operations
Level: low