Potentially Suspicious Usage Of Qemu For Network Tunneling
Detects potentially suspicious execution of the Qemu utility in a Windows environment. Threat actors have leveraged this utility and this technique for achieving network access as reported by Kaspersky. The rule specifically looks for Qemu command-line arguments indicative of network tunneling or proxying, such as low memory allocation ('-m 1M', '-m 2M', '-m 3M'), network device configuration ('-netdev', 'connect='), and running without a graphical interface ('-nographic'), while filtering out common legitimate use cases like CD-ROM or virtual block device usage.
Sigma
