QEMU Virtualized SSH Backdoor via TPMProfiler Scheduled Task

Ethan Andrews@eandrews

•updated Feb 9, 2026•4•0•47

Detects a specific persistence mechanism where a scheduled task named 'TPMProfiler' is used to run QEMU, establishing an SSH backdoor. This technique was identified by Huntress in post-exploitation activity related to SolarWinds WHD exploitation. The rule identifies both the execution of QEMU with SSH port forwarding command-line arguments and the creation of the malicious scheduled task.