Root shell or child process spawned by VMM (qemu/firecracker) on Linux host
Detects virtualization management monitor (VMM) processes such as QEMU or Firecracker directly spawning an interactive shell, script interpreter, or network utility as the root user. This behavior is highly anomalous and may indicate a guest-to-host escape leading to remote code execution on the host.
Microsoft Sentinel (KQL)
