cyberstrikeus T1564.006 Run Virtual Instance
Sub-technique of: T1564
High-Level Description
Adversaries may carry out malicious operations using a virtual instance to avoid detection. A wide variety of virtualization technologies exist that allow for the emulation of a computer or computing environment. By running malicious code inside of a virtual instance, adversaries can hide artifacts associated with their behavior from security tools that are unable to monitor activity inside the virtual instance. Additionally, depending on the virtual networking implementation (ex: bridged adapter), network traffic generated by the virtual instance can be difficult to trace back to the compromised host as the IP address and hostname might not match known values.
Adversaries may utilize native support for virtualization (ex: Hyper-V), deploy lightweight emulators (ex: QEMU), or drop the necessary files to run a virtual instance (ex: VirtualBox binaries). After running a virtual instance, adversaries may create a shared folder between the guest and host with permissions that enable the virtual instance to interact with the host file system.
Threat actors may also leverage temporary virtualized environments such as the Windows Sandbox, which supports the use of .wsb configuration files for defining execution parameters. For example, the <MappedFolder> property supports the creation of a shared folder, while the <LogonCommand> property allows the specification of a payload.
In VMWare environments, adversaries may leverage the vCenter console to create new virtual machines. However, they may also create virtual machines directly on ESXi servers by running a valid .vmx file with the /bin/vmx utility. Adding this command to /etc/rc.local.d/local.sh (i.e., RC Scripts) will cause the VM to persistently restart. Creating a VM this way prevents it from appearing in the vCenter console or in the output to the vim-cmd vmsvc/getallvms command on the ESXi server, thereby hiding it from typical administrative activities.
Kill Chain Phase
- Defense Evasion (TA0005)
Platforms: Linux, macOS, Windows, ESXi
What to Check
- Identify if Run Virtual Instance technique is applicable to target environment
- Check Linux systems for indicators of Run Virtual Instance
- Check macOS systems for indicators of Run Virtual Instance
- Check Windows systems for indicators of Run Virtual Instance
- Verify mitigations are bypassed or absent (3 known mitigations)
- Assess detection coverage (1 detection strategies)
How to Test
Atomic Red Team Tests
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Atomic Test 1: Register Portable Virtualbox
ransomware payloads via virtual machines (VM). Maze ransomware
Supported Platforms: windows
"C:\Program Files\Oracle\VirtualBox\VBoxSVC.exe" /reregserver
regsvr32 /S "C:\Program Files\Oracle\VirtualBox\VboxC.dll"
rundll32 "C:\Program Files\Oracle\VirtualBox\VBoxRT.dll,RTR3Init"
sc create VBoxDRV binpath= "C:\Program Files\Oracle\VirtualBox\drivers\VboxDrv.sys" type= kernel start= auto error= normal displayname= PortableVBoxDRV
sc start VBoxDRV
Dependencies:
- MSI file must exist on disk at specified location (#{msi_file_path})
- CAB file must exist on disk at specified location (#{cab_file_path})
- Old version of Virtualbox must be installed
Atomic Test 2: Create and start VirtualBox virtual machine
Create a simple VirtualBox VM and start up the machine Cleanup command stops and deletes the newly created VM and associated files https://www.virtualbox.org/manual/ch08.html#vboxmanage-startvm https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/ https://attack.mitre.org/techniques/T1564/006/
Supported Platforms: windows
"#{vboxmanage_exe}" createvm --name "#{vm_name}" --register
"#{vboxmanage_exe}" modifyvm "#{vm_name}" --firmware efi
"#{vboxmanage_exe}" startvm "#{vm_name}"
Dependencies:
- VirtualBox must exist on disk at specified locations (#{virtualbox_exe})
- VBoxManage must exist on disk at specified locations (#{vboxmanage_exe})
Atomic Test 3: Create and start Hyper-V virtual machine
Create a simple Hyper-V VM (Windows native hypervisor) and start up the machine Cleanup command stops and deletes the newly created VM https://docs.microsoft.com/en-us/virtualization/hyper-v-on-windows/quick-start/enable-hyper-v https://embracethered.com/blog/posts/2020/shadowbunny-virtual-machine-red-teaming-technique/ https://attack.mitre.org/techniques/T1564/006/
Supported Platforms: windows Elevation Required: Yes
$VM = "#{vm_name}"
New-VM -Name $VM -Generation 2
Set-VMFirmware $VM -EnableSecureBoot Off
Start-VM $VM
Dependencies:
- Hyper-V must be enabled on the system Checks whether Hyper-V is enabled. If not, enables Hyper-V and forces a required restart
Manual Testing
If Atomic Red Team tests are not applicable, manually verify the technique by:
Identify Attack Surface: Determine if the target environment is susceptible to Run Virtual Instance by examining the target platforms (Linux, macOS, Windows).
Assess Existing Defenses: Review whether mitigations for T1564.006 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Remediation Guide
M1042 Disable or Remove Feature or Program
Disable native virtualization technologies such as Hyper-V if not necessary within a given environment. Consider also disabling Windows Sandbox if it is not needed to test or debug applications.
M1047 Audit
Periodically audit virtual machines for abnormalities. On ESXi servers, periodically compare the output of vim-cmd vmsvc/getallvms, which lists all VMs in vCenter, and escxli vm process list | grep Display, which lists all VMs hosted on ESXi.
M1038 Execution Prevention
Use application control to mitigate installation and use of unapproved virtualization software.
Detection
Detection Strategy for Hidden Virtual Instance Execution
Risk Assessment
| Finding | Severity | Impact |
|---|---|---|
| Run Virtual Instance technique applicable | Low | Defense Evasion |
CWE Categories
| CWE ID | Title |
|---|---|
| CWE-693 | Protection Mechanism Failure |