Suspicious VBoxDrvInst.exe Parameters for INF Processing

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•13

This rule detects the execution of 'VBoxDrvInst.exe' with specific parameters ('driver' and 'executeinf') that allow it to process INF files. This capability can be abused to create registry values and install drivers, potentially leading to persistence mechanisms such as modifying Run or RunOnce registry keys.