Suspicious Hyper-V Cmdlets Execution

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•27

This rule detects the execution of specific PowerShell cmdlets related to Hyper-V virtual machine management. Adversaries may use these cmdlets to create, configure, or start virtual machines to evade detection by isolating malicious activities within a virtualized environment. The rule specifically looks for 'New-VM', 'Set-VMFirmware', and 'Start-VM' within PowerShell script block text.