Paco Pina
@pacopi0 followers11 downloads4 copies0 likes45 views
1 detection
Filters
Last updated
All Time
Detection languages
1
Categories
1
1
Platforms
1
MITRE Techniques
1
1
Detects the execution of QEMU with parameters to launch a virtual machine with a disk image and networking capabilities. Adversaries have been observed using this "Bring Your Own VM" (BYO-VM) technique to create an isolated operational environment on a compromised host, evading host-based defenses and establishing persistence. This activity was notably preceded by social engineering via Quick Assist, leading to execution by "wscript.exe".
