Suspicious QEMU Execution To Run Adversary VM
Detects the execution of QEMU with parameters to launch a virtual machine with a disk image and networking capabilities. Adversaries have been observed using this "Bring Your Own VM" (BYO-VM) technique to create an isolated operational environment on a compromised host, evading host-based defenses and establishing persistence. This activity was notably preceded by social engineering via Quick Assist, leading to execution by "wscript.exe".
Sigma
