QEMU Process Establishing Suspicious Outbound Network Connections for Covert C2

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

This rule detects qemu-system processes acting as parents for known tunneling or network utility tools, or qemu-system instances explicitly configured with suspicious command-line parameters (e.g., tap, socket connect, virtio-net) indicative of covert command and control (C2) communication. This behavior is associated with threat actors using Alpine Linux virtual machines within QEMU to bypass host EDR visibility.