Virtualbox Driver Installation or Starting of VMs

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•1

Adversaries can carry out malicious operations using a virtual instance to avoid detection. This rule is built to detect the registration of the Virtualbox driver or start of a Virtualbox VM.