QEMU SSH Backdoor via Hostfwd with vault.db or bisrv.dll

Daniel Jeremiah@daniyyell

•updated Feb 9, 2026•0•14

This rule detects the creation of a process that involves 'qemu' in its image path and contains 'hostfwd=tcp' along with either 'vault.db' or 'bisrv.dll' in its command line. This combination is indicative of an SSH backdoor deployment, specifically observed in the context of SolarWinds Web Help Desk exploitation where threat actors establish persistence using a scheduled task named TPMProfiler to execute QEMU with an SSH port forward.