T1564.006 Hide Artifacts: Run Virtual Instance

Adversaries may carry out malicious operations using a virtual instance to avoid detection. MITRE ATT&CK

1 program on CmdID 1 Sigma rule T1564.006 on attack.mitre.org

Part of

MITRE ATT&CK

T1564Hide Artifacts

documented by LOLBAS and GTFOBins, or named by its rules

process creation, the highest levels first

everyday examples from tldr-pages, CC BY 4.0

Start a virtual machine on the page for virtualboxvm

virtualboxvm --startvm nameIdentify

Start a virtual machine in fullscreen mode on the page for virtualboxvm

virtualboxvm --startvm name --fullscreenIdentify

Mount the specified DVD image file on the page for virtualboxvm

virtualboxvm --startvm name --dvd path\to\image_fileIdentify

Display a command-line window with debug information on the page for virtualboxvm

virtualboxvm --startvm name --debug-command-lineIdentify

Start a virtual machine in a paused state on the page for virtualboxvm

virtualboxvm --startvm name --start-pausedIdentify

An example is here when CmdID’s reading of it names T1564.006: a Sigma rule it trips is tagged with it, or its abuse is documented as it.