Zapscape (CVE-2026-64561) — KVM/x86 nested-virt guest-to-host escape
Detects the execution of common shell utilities, interpreters, or configuration commands initiated by QEMU or KVM processes. This often indicates the use of virtualized environments to execute payloads, bypass security controls, or hide artifacts within a host system, especially when correlated with process crashes related to hypervisor components.
Microsoft Sentinel (KQL)
