GOLD ENCOUNTER QEMU Guest VM Execution with Networking Args on Windows
Detects the execution of QEMU binary variants (qemu-system-x86_64.exe, qemu-system-i386.exe, or qemu.exe) when invoked with arguments indicative of guest networking or disk usage (e.g., -netdev, -drive). The rule further filters by identifying suspicious execution paths (e.g., Temp, AppData) or lack of legitimate hypervisor parent processes to identify potentially unauthorized virtualization or sandbox evasion activity.
Splunk (SPL)
