Rule Info
Name
VirtualBox Binary Masquerading
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Description
Detects execution of binaries using VirtualBox-related filenames which are not the legitimate VirtualBox binaries.
This may indicate an attempt to masquerade malicious binaries as VirtualBox components to evade detection.
Date
2026-07-05 00:00:00
Modified
None
Id
b2e5d8f4-3c96-4a7b-85d1-7e3f9c2b6a4d
Tags
attack.stealth attack.t1036.005
Type
Nextron Sigma feed only (private)
Rule History
Scan your endpoints, forensic images or collected files with our portable scanner THOR