Suspicious Hyper-V VM Creation via PowerShell or Management Tooling

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects the creation of virtual machines or the attachment of virtual hard disks (VHDs) using Hyper-V management tools, PowerShell, or Windows Disk Management utilities. This activity is often associated with efforts to bypass endpoint security monitoring by executing payloads within an unmanaged guest VM environment.