Potentially Suspicious Usage Of Qemu - Virtual Machine Created With Very Low RAM Size

Nasreddine Bencherchali (Nextron Systems)

Detects potentially suspicious execution of the Qemu utility in a Windows environment where the allocated size for the Virtual Machine is very low. This could be a sign of abuse as shown by threat actors that have leveraged this utility and this technique for achieving network access as reported by Kaspersky.

2024-06-04 00:00:00

None

53fab9d4-fb29-4bdf-99b5-376a5886a589

attack.command_and_control attack.t1090 attack.t1572

Nextron Sigma feed only (private)