VirtualBox Driver Installation or VM Start
This rule detects the installation of VirtualBox drivers or the initiation of VirtualBox virtual machines. Adversaries, particularly ransomware groups like Ragnar Locker and Maze, have been observed using virtual instances to execute malicious operations, thereby evading detection by security tools on the host system. The rule specifically looks for command-line arguments related to VirtualBox driver components (VBoxRT.dll, VBoxC.dll, VBoxDrv.sys) or commands used to start/control virtual machines ('startvm', 'controlvm').
Sigma
