Virtual Machine Spun Up to Hide Malicious Activity

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects HTTP traffic where the host header or URI contains keywords associated with virtual machine software (virtualbox, vmware, qemu) and the URI also contains the word "create". This combination suggests the potential creation or interaction with virtual machines, which could be used for defense evasion by adversaries to hide malicious activity.