ATT&CK technique
View on MITRE ATT&CK →
T1564.006
Run Virtual Instance
Stealth
6 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Claude Cowork VM Boot Image Tamper | production | 2026-09-25 |
| elastic | Windows Sandbox with Sensitive Configuration | production | 2026-09-18 |
| splunk | Windows ConHost with Headless Argument | production | 2026-05-13 |
| splunk | Windows Suspicious QEMU Execution | production | 2026-05-13 |
| sigma | Virtualbox Driver Installation or Starting of VMs | test | 2025-07-29 |
| sigma | Suspicious Hyper-V Cmdlets | test | 2022-04-09 |