QEMU Virtualized Persistence for Evasion
Detects the use of QEMU with port forwarding (`hostfwd`), a technique observed being used by attackers to create a persistent, virtualized environment for C2 and lateral movement, often via a scheduled task. The rule looks for the creation of scheduled tasks that launch QEMU with port forwarding or the direct execution of QEMU with port forwarding by common parent processes associated with scheduled tasks or remote administration.
Microsoft Sentinel (KQL)
