Hidden QEMU Virtual Machine Execution
Detects instances of QEMU emulators, particularly renamed binaries (e.g., svvhost.exe), executing with arguments indicative of loading a .qcow2 virtual disk image. BlackSuit affiliates are known to deploy QEMU virtual machines containing Linux or Windows operating systems to conceal backdoor proxy tools from host-level EDR.
Sigma
