T1564.006 Run Virtual Instance Mappings

Adversaries may carry out malicious operations using a virtual instance to avoid detection. A wide variety of virtualization technologies exist that allow for the emulation of a computer or computing environment. By running malicious code inside of a virtual instance, adversaries can hide artifacts associated with their behavior from security tools that are unable to monitor activity inside the virtual instance. Additionally, depending on the virtual networking implementation (ex: bridged adapter), network traffic generated by the virtual instance can be difficult to trace back to the compromised host as the IP address and hostname might not match known values.(Citation: SingHealth Breach Jan 2019)

Adversaries may utilize native support for virtualization (ex: Hyper-V) or drop the necessary files to run a virtual instance (ex: VirtualBox binaries). After running a virtual instance, adversaries may create a shared folder between the guest and host with permissions that enable the virtual instance to interact with the host file system.(Citation: Sophos Ragnar May 2020)

View in MITRE ATT&CK®

Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name
CM-2 Baseline Configuration Protects T1564.006 Run Virtual Instance
CM-6 Configuration Settings Protects T1564.006 Run Virtual Instance
CM-7 Least Functionality Protects T1564.006 Run Virtual Instance
CM-8 System Component Inventory Protects T1564.006 Run Virtual Instance
SI-10 Information Input Validation Protects T1564.006 Run Virtual Instance
SI-4 System Monitoring Protects T1564.006 Run Virtual Instance
SI-7 Software, Firmware, and Information Integrity Protects T1564.006 Run Virtual Instance
azure_security_center_recommendations Azure Security Center Recommendations technique_scores T1564.006 Run Virtual Instance
linux_auditd_alerts_and_log_analytics_agent_integration Linux auditd alerts and Log Analytics agent integration technique_scores T1564.006 Run Virtual Instance