QEMU Process Spawning Credential Harvesting Tools (Impacket/NetExec/Metasploit)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•6

This rule detects the execution of known offensive security and post-exploitation toolsets (such as Impacket, Metasploit, CrackMapExec, or NetExec) when initiated from virtualization processes like QEMU. This pattern is indicative of an adversary executing malicious payloads from within a virtual machine or using virtualization software as a proxy for malicious activity on the host.