T1564.006 Run Virtual Instance

> Sub-technique of: T1564

High-Level Description

Adversaries may carry out malicious operations using a virtual instance to avoid detection. A wide variety of virtualization technologies exist that allow for the emulation of a computer or computing environment. By running malicious code inside of a virtual instance, adversaries can hide artifacts associated with their behavior from security tools that are unable to monitor activity inside the virtual instance. Additionally, depending on the virtual networking implementation (ex: bridged adapter), network traffic generated by the virtual instance can be difficult to trace back to the compromised host as the IP address and hostname might not match known values.

Adversaries may utilize native support for virtualization (ex: Hyper-V), deploy lightweight emulators (ex: QEMU), or drop the necessary files to run a virtual instance (ex: VirtualBox binaries). After running a virtual instance, adversaries may create a shared folder between the guest and host with permissions that enable the virtual instance to interact with the host file system.

Threat actors may also leverage temporary virtualized environments such as the Windows Sandbox, which supports the use of .wsb configuration files for defining execution parameters. For example, the <MappedFolder> property supports the creation of a shared folder, while the <LogonCommand> property allows the specification of a payload.

In VMWare environments, adversaries may leverage the vCenter console to create new virtual machines. However, they may also create virtual machines directly on ESXi servers by running a valid .vmx file with the /bin/vmx utility. Adding this command to /etc/rc.local.d/local.sh (i.e., RC Scripts) will cause the VM to persistently restart. Creating a VM this way prevents it from appearing in the vCenter console or in the output to the vim-cmd vmsvc/getallvms command on the ESXi server, thereby hiding it from typical administrative activities.

Kill Chain Phase

• Defense Evasion (TA0005)

Platforms: Linux, macOS, Windows, ESXi

What to Check

• ] Identify if Run Virtual Instance technique is applicable to target environment
• ] Check Linux systems for indicators of Run Virtual Instance
• ] Check macOS systems for indicators of Run Virtual Instance
• ] Check Windows systems for indicators of Run Virtual Instance
• ] Verify mitigations are bypassed or absent (3 known mitigations)
• ] Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Register Portable Virtualbox

ransomware payloads via virtual machines (VM). Maze ransomware

Supported Platforms: windows

cmd
"C:\Program Files\Oracle\VirtualBox\VBoxSVC.exe" /reregserver
regsvr32 /S "C:\Program Files\Oracle\VirtualBox\VboxC.dll"
rundll32 "C:\Program Files\Oracle\VirtualBox\VBoxRT.dll,RTR3Init"
sc create VBoxDRV binpath= "C:\Program Files\Oracle\VirtualBox\drivers\VboxDrv.sys" type= kernel start= auto error= normal displayname= PortableVBoxDRV
sc start VBoxDRV

Dependencies:

• MSI file must exist on disk at specified location (#{msi_file_path})
• CAB file must exist on disk at specified location (#{cab_file_path})
• Old version of Virtualbox must be installed

Atomic Test 2: Create and start VirtualBox virtual machine

Create a simple VirtualBox VM and start up the machine Cleanup command stops and deletes the newly created VM and associated files https://www.virtualbox.org/manual/ch08.html#vboxmanage-startvm https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/ https://attack.mitre.org/techniques/T1564/006/

Supported Platforms: windows

cmd
"#{vboxmanage_exe}" createvm --name "#{vm_name}" --register
"#{vboxmanage_exe}" modifyvm "#{vm_name}" --firmware efi
"#{vboxmanage_exe}" startvm "#{vm_name}"

Dependencies:

• VirtualBox must exist on disk at specified locations (#{virtualbox_exe})
• VBoxManage must exist on disk at specified locations (#{vboxmanage_exe})

Atomic Test 3: Create and start Hyper-V virtual machine

Create a simple Hyper-V VM (Windows native hypervisor) and start up the machine Cleanup command stops and deletes the newly created VM https://docs.microsoft.com/en-us/virtualization/hyper-v-on-windows/quick-start/enable-hyper-v https://embracethered.com/blog/posts/2020/shadowbunny-virtual-machine-red-teaming-technique/ https://attack.mitre.org/techniques/T1564/006/

Supported Platforms: windows Elevation Required: Yes

powershell
$VM = "#{vm_name}"
New-VM -Name $VM -Generation 2
Set-VMFirmware $VM -EnableSecureBoot Off
Start-VM $VM

Dependencies:

• Hyper-V must be enabled on the system

Checks whether Hyper-V is enabled. If not, enables Hyper-V and forces a required restart

Manual Testing

If Atomic Red Team tests are not applicable, manually verify the technique by:

1. Identify Attack Surface: Determine if the target environment is susceptible to Run Virtual Instance by examining the target platforms (Linux, macOS, Windows).

1. Assess Existing Defenses: Review whether mitigations for T1564.006 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

1. Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.

Remediation Guide

M1042 Disable or Remove Feature or Program

Disable native virtualization technologies such as Hyper-V if not necessary within a given environment. Consider also disabling Windows Sandbox if it is not needed to test or debug applications.

M1047 Audit

Periodically audit virtual machines for abnormalities. On ESXi servers, periodically compare the output of vim-cmd vmsvc/getallvms, which lists all VMs in vCenter, and escxli vm process list | grep Display, which lists all VMs hosted on ESXi.

M1038 Execution Prevention

Use application control to mitigate installation and use of unapproved virtualization software.

Detection

Detection Strategy for Hidden Virtual Instance Execution

Risk Assessment

| Finding | Severity | Impact | | ----------------------------------------- | -------- | --------------- | | Run Virtual Instance technique applicable | Low | Defense Evasion |

CWE Categories

| CWE ID | Title | | ------- | ---------------------------- | | CWE-693 | Protection Mechanism Failure |

References

• ESET MirrorFace 2025
• vNinja Rogue VMs 2024
• SingHealth Breach Jan 2019
• CyberCX Akira Ransomware
• Securonix CronTrap 2024
• Shadowbunny VM Defense Evasion
• MITRE VMware Abuse 2024
• Sophos Ragnar May 2020
• Atomic Red Team - T1564.006
• MITRE ATT&CK - T1564.006