Live Active security incident? Get immediate response
MITRE ATT&CK® Technique

T1564.006: Run Virtual Instance

Adversaries may carry out malicious operations using a virtual instance to avoid detection. A wide variety of virtualization technologies exist that allow for the emulation of a computer or computing environment. By running malicious code inside of a virtual instance, adversaries can hide artifacts associated with their behavior from security tools that are unable to monitor activity inside the virtual instance.[1] Additionally, depending on the virtual networking implementation (ex: bridged adapter), network traffic generated by the virtual instance can be difficult to trace back to the compromised host as the IP address and hostname might not match known values.[2]

Adversaries may utilize native support for virtualization (ex: Hyper-V), deploy lightweight emulators (ex: QEMU), or drop the necessary files to run a virtual instance (ex: VirtualBox binaries).[3] After running a virtual instance, adversaries may create a shared folder between the guest and host with permissions that enable the virtual instance to interact with the host file system.[4]

Threat actors may also leverage temporary virtualized environments such as the Windows Sandbox, which supports the use of `.wsb` configuration files for defining execution parameters. For example, the `` property supports the creation of a shared folder, while the `` property allows the specification of a payload.[5][6][7]

In VMWare environments, adversaries may leverage the vCenter console to create new virtual machines. However, they may also create virtual machines directly on ESXi servers by running a valid `.vmx` file with the `/bin/vmx` utility. Adding this command to `/etc/rc.local.d/local.sh` (i.e., RC Scripts) will cause the VM to persistently restart.[8] Creating a VM this way prevents it from appearing in the vCenter console or in the output to the `vim-cmd vmsvc/getallvms` command on the ESXi server, thereby hiding it from typical administrative activities.[9]

EnterpriseT1564.006Sub-techniqueObject v2.0 Modified
Discuss defensive coverage Back to ATT&CK
Glexia's Take

Analyst context for executives and security teams

Analyst confidence High

Run Virtual Instance matters because an attacker can move malicious activity into a guest VM, emulator, Windows Sandbox, or rogue ESXi VM where normal endpoint and administrative visibility may not reach. The business risk is not virtualization itself; it is the blind spot created when security teams monitor the host, vCenter, or known asset names but not what runs inside or beside them.

Executive priority

Treat this as a coverage and governance issue for endpoint, server, and virtualization estates. Leaders should ask whether unauthorized virtualization tools, Windows Sandbox use, shared host/guest folders, rogue ESXi VMs, and VM-generated network traffic are visible in audit evidence and incident response procedures. This is especially relevant where ransomware readiness, SOC visibility, compliance logging, or VMware/ESXi operational resilience are priorities.

Technical view

This sub-technique sits under Hide Artifacts and applies to ESXi, Linux, macOS, and Windows. ATT&CK provides no native detection text, but a related detection strategy, DET0321, is mapped. SOC and IR teams should validate visibility for creation and execution of virtual instances, use of native virtualization such as Hyper-V or Windows Sandbox, lightweight emulators such as QEMU, dropped virtualization binaries such as VirtualBox components, .wsb configuration files with mapped folders or logon commands, and ESXi-side VM execution using .vmx files and /bin/vmx. In VMware environments, do not rely only on vCenter inventory or vim-cmd vmsvc/getallvms, because the ATT&CK description notes cases where direct ESXi execution may not appear there.

Likely telemetry

  • Endpoint process creation and command-line telemetry for virtualization binaries, emulators, sandbox launch activity, and related child processes
  • File creation and modification events for .wsb files, .vmx files, dropped virtualization binaries, and shared-folder configuration artifacts
  • Windows, Linux, macOS, and ESXi audit logs showing virtualization feature use, shell activity, and startup or persistence changes such as /etc/rc.local.d/local.sh
  • VMware/ESXi and vCenter administrative logs, with attention to discrepancies between host-level activity and central inventory
  • Network telemetry for traffic from unexpected VM IP addresses, hostnames, bridged adapters, or addresses not matching known host inventory

Detection direction

  • Baseline authorized virtualization technologies by platform and role, then alert on unexpected VM, emulator, sandbox, or virtualization binary execution.
  • Correlate host endpoint telemetry with network identity data; investigate traffic whose IP address or hostname does not match the expected compromised or managed host context.
  • For ESXi, compare vCenter inventory with host-level evidence and startup scripts; look for valid .vmx execution paths that may bypass typical administrative views.
  • Review .wsb configuration files for mapped folders and logon commands, while tuning for legitimate administrative or testing use.
  • Prioritize detections around shared folders between guest and host because they can allow activity inside the VM to affect host files.

Mitigation priorities

  • Use Execution Prevention (M1038) to restrict unauthorized virtualization binaries, emulators, scripts, and sandbox launch paths where business use does not require them.
  • Disable or remove unnecessary virtualization features or programs (M1042), including unused native virtualization capabilities or tools on endpoints and servers.
  • Implement auditing (M1047) for virtualization feature use, VM creation, ESXi host activity, startup scripts, shared-folder configuration, and administrative console actions.
  • Maintain an approved inventory of virtualization platforms and expected VM/network relationships, including ESXi hosts and workloads that may not be visible through only one management plane.
  • Ensure incident response playbooks include checks for hidden or rogue virtual instances, especially when endpoint alerts are sparse but network or file activity suggests additional execution context.
Analyst notes and limits

Relationship context links this behavior to Maze, LoudMiner, and Ragnar Locker software, and to mitigation objects for execution prevention, feature removal, and auditing. Those relationships support defensive prioritization but should not be read as evidence that any specific environment is affected. The key Glexia validation question is whether existing SOC tooling can see both the host and the virtualized execution context.

The official ATT&CK object does not provide detection guidance, and supplied relationships do not include detailed DET0321 content. Local platform configuration, approved virtualization use, ESXi logging posture, network architecture, and endpoint control coverage are required to determine practical detection fidelity.

Official MITRE ATT&CK definition

Run Virtual Instance

Adversaries may carry out malicious operations using a virtual instance to avoid detection. A wide variety of virtualization technologies exist that allow for the emulation of a computer or computing environment. By running malicious code inside of a virtual instance, adversaries can hide artifacts associated with their behavior from security tools that are unable to monitor activity inside the virtual instance.[1] Additionally, depending on the virtual networking implementation (ex: bridged adapter), network traffic generated by the virtual instance can be difficult to trace back to the compromised host as the IP address and hostname might not match known values.[2]

Adversaries may utilize native support for virtualization (ex: Hyper-V), deploy lightweight emulators (ex: QEMU), or drop the necessary files to run a virtual instance (ex: VirtualBox binaries).[3] After running a virtual instance, adversaries may create a shared folder between the guest and host with permissions that enable the virtual instance to interact with the host file system.[4]

Threat actors may also leverage temporary virtualized environments such as the Windows Sandbox, which supports the use of `.wsb` configuration files for defining execution parameters. For example, the `` property supports the creation of a shared folder, while the `` property allows the specification of a payload.[5][6][7]

In VMWare environments, adversaries may leverage the vCenter console to create new virtual machines. However, they may also create virtual machines directly on ESXi servers by running a valid `.vmx` file with the `/bin/vmx` utility. Adding this command to `/etc/rc.local.d/local.sh` (i.e., RC Scripts) will cause the VM to persistently restart.[8] Creating a VM this way prevents it from appearing in the vCenter console or in the output to the `vim-cmd vmsvc/getallvms` command on the ESXi server, thereby hiding it from typical administrative activities.[9]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

1 rows
Domain ID Name Relationship / procedure
Enterprise T1564 Hide Artifacts This object subtechnique of Hide Artifacts.
Associated objects

Groups, software, and campaigns

Malware Enterprise

S0449: Maze

Maze ransomware, previously known as "ChaCha", was discovered in May 2019. In addition to encrypting files on victim machines for impact, Maze operators conduct information stealing campaigns prior to encryption and post the information online to extort affected companies.[1][2][3]

Windows
Malware Enterprise

S0451: LoudMiner

LoudMiner is a cryptocurrency miner which uses virtualization software to siphon system resources. The miner has been bundled with pirated copies of Virtual Studio Technology (VST) for Windows and macOS.[1]

macOSWindows
Relationship explorer

All related ATT&CK context

mitigates · Mitigation M1042: Disable or Remove Feature or Program Enterprise mitigates · Mitigation M1047: Audit Enterprise uses · Malware S0449: Maze Enterprise detects · Detection Strategy DET0321: Detection Strategy for Hidden Virtual Instance Execution Enterprise subtechnique of · Technique T1564: Hide Artifacts Enterprise uses · Malware S0481: Ragnar Locker Enterprise uses · Malware S0451: LoudMiner Enterprise mitigates · Mitigation M1038: Execution Prevention Enterprise
Mitigations

Mitigation direction

Mitigation Enterprise

M1042: Disable or Remove Feature or Program

Disable or remove unnecessary and potentially vulnerable software, features, or services to reduce the attack surface and prevent abuse by adversaries. This involves identifying software or features that are no longer needed or that could be exploited and ensuring they are either removed or properly disabled. This mitigation can be implemented through the following measures:

Remove Legacy Software:

- Use Case: Disable or remove older versions of software that no longer receive updates or security patches (e.g., legacy Java, Adobe Flash). - Implementation: A company removes Flash Player from all employee systems after it has reached its end-of-life date.

Disable Unused Features:

- Use Case: Turn off unnecessary operating system features like SMBv1, Telnet, or RDP if they are not required. - Implementation: Disable SMBv1 in a Windows environment to mitigate vulnerabilities like EternalBlue.

Control Applications Installed by Users:

- Use Case: Prevent users from installing unauthorized software via group policies or other management tools. - Implementation: Block user installations of unauthorized file-sharing applications (e.g., BitTorrent clients) in an enterprise environment.

Remove Unnecessary Services:

- Use Case: Identify and disable unnecessary default services running on endpoints, servers, or network devices. - Implementation: Disable unused administrative shares (e.g., C$, ADMIN$) on workstations.

Restrict Add-ons and Plugins:

- Use Case: Remove or disable browser plugins and add-ons that are not needed for business purposes. - Implementation: Disable Java and ActiveX plugins in web browsers to prevent drive-by attacks.

Mitigation Enterprise

M1047: Audit

Auditing is the process of recording activity and systematically reviewing and analyzing the activity and system configurations. The primary purpose of auditing is to detect anomalies and identify potential threats or weaknesses in the environment. Proper auditing configurations can also help to meet compliance requirements. The process of auditing encompasses regular analysis of user behaviors and system logs in support of proactive security measures.

Auditing is applicable to all systems used within an organization, from the front door of a building to accessing a file on a fileserver. It is considered more critical for regulated industries such as, healthcare, finance and government where compliance requirements demand stringent tracking of user and system activates.This mitigation can be implemented through the following measures:

System Audit:

- Use Case: Regularly assess system configurations to ensure compliance with organizational security policies. - Implementation: Use tools to scan for deviations from established benchmarks.

Permission Audits:

- Use Case: Review file and folder permissions to minimize the risk of unauthorized access or privilege escalation. - Implementation: Run access reviews to identify users or groups with excessive permissions.

Software Audits:

- Use Case: Identify outdated, unsupported, or insecure software that could serve as an attack vector. - Implementation: Use inventory and vulnerability scanning tools to detect outdated versions and recommend secure alternatives.

Configuration Audits:

- Use Case: Evaluate system and network configurations to ensure secure settings (e.g., disabled SMBv1, enabled MFA). - Implementation: Implement automated configuration scanning tools like SCAP (Security Content Automation Protocol) to identify non-compliant systems.

Network Audits:

- Use Case: Examine network traffic, firewall rules, and endpoint communications to identify unauthorized or insecure connections. - Implementation: Utilize tools such as Wireshark, or Zeek to monitor and log suspicious network behavior.

Mitigation Enterprise

M1038: Execution Prevention

Prevent the execution of unauthorized or malicious code on systems by implementing application control, script blocking, and other execution prevention mechanisms. This ensures that only trusted and authorized code is executed, reducing the risk of malware and unauthorized actions. This mitigation can be implemented through the following measures:

Application Control:

- Use Case: Use tools like AppLocker or Windows Defender Application Control (WDAC) to create whitelists of authorized applications and block unauthorized ones. On Linux, use tools like SELinux or AppArmor to define mandatory access control policies for application execution. - Implementation: Allow only digitally signed or pre-approved applications to execute on servers and endpoints. (e.g., `New-AppLockerPolicy -PolicyType Enforced -FilePath "C:\Policies\AppLocker.xml"`)

Script Blocking:

- Use Case: Use script control mechanisms to block unauthorized execution of scripts, such as PowerShell or JavaScript. Web Browsers: Use browser extensions or settings to block JavaScript execution from untrusted sources. - Implementation: Configure PowerShell to enforce Constrained Language Mode for non-administrator users. (e.g., `Set-ExecutionPolicy AllSigned`)

Executable Blocking:

- Use Case: Prevent execution of binaries from suspicious locations, such as `%TEMP%` or `%APPDATA%` directories. - Implementation: Block execution of `.exe`, `.bat`, or `.ps1` files from user-writable directories.

Dynamic Analysis Prevention: - Use Case: Use behavior-based execution prevention tools to identify and block malicious activity in real time. - Implemenation: Employ EDR solutions that analyze runtime behavior and block suspicious code execution.

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
2.0
Created
Modified
Raw hash
ea1afa95b970e6c4...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 2.0 Current bundle ea1afa95b970…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    CyberCX Akira Ransomware

    CyberCX. (2023, September 15). Weaponising VMs to bypass EDR – Akira ransomware. Retrieved April 4, 2025.

    Open source URL
  2. [2]
    SingHealth Breach Jan 2019

    Committee of Inquiry into the Cyber Attack on SingHealth. (2019, January 10). Public Report of the Committee of Inquiry into the Cyber Attack on Singapore Health Services Private Limited's Patient Database. Retrieved June 29, 2020.

    Open source URL
  3. [3]
    Securonix CronTrap 2024

    Den Iuzvyk and Tim Peck. (2024, November 4). CRON#TRAP: Emulated Linux Environments as the Latest Tactic in Malware Staging. Retrieved May 22, 2025.

    Open source URL
  4. [4]
    Sophos Ragnar May 2020

    SophosLabs. (2020, May 21). Ragnar Locker ransomware deploys virtual machine to dodge security. Retrieved June 29, 2020.

    Open source URL
  5. [5]
    ESET MirrorFace 2025

    Dominik Breitenbacher. (2025, March 18). Operation AkaiRyū: MirrorFace invites Europe to Expo 2025 and revives ANEL backdoor. Retrieved May 22, 2025.

    Open source URL
  6. [6]
    ITOCHU Hack the Sandbox

    ITOCHU Cyber & Intelligence Inc.. (2025, March 12). Hack The Sandbox: Unveiling the Truth Behind Disappearing Artifacts. Retrieved November 5, 2025.

    Open source URL
  7. [7]
    ITOCHU Sandbox PPT

    ITOCHU Cyber & Intelligence Inc.. (n.d.). Hack The Sandbox: Unveiling the Truth Behind Disappearing Artifacts. Retrieved November 5, 2025.

    Open source URL
  8. [8]
    vNinja Rogue VMs 2024

    Christian Mohn. (2024, November 11). Beware Of The Rogue VMs!. Retrieved March 26, 2025.

    Open source URL
  9. [9]
    MITRE VMware Abuse 2024

    Lex Crumpton. (2024, May 22). Infiltrating Defenses: Abusing VMware in MITRE’s Cyber Intrusion. Retrieved March 26, 2025.

    Open source URL
  10. [10]
    mitre-attack T1564.006
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use