Detect Hypervisor in Google Chronicle

rule t1062_hypervisor_install_indicators {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects T1062 Hypervisor pre-installation indicators including bcdedit boot configuration changes, hypervisor driver file drops, registry service entries for hypervisor binaries, and EFI/boot sector modification by untrusted processes."
    mitre_attack_tactic = "Persistence"
    mitre_attack_technique = "T1062"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1062/"
    severity = "CRITICAL"
    priority = "HIGH"
    status = "PRODUCTION"
    created = "2026-04-16"

  events:
    (
      // Branch 1: bcdedit modifying hypervisor boot configuration
      (
        $e.metadata.event_type = "PROCESS_LAUNCH"
        and re.regex($e.target.process.file.full_path, `(?i)bcdedit\.exe`)
        and (
          re.regex($e.target.process.command_line, `(?i)hypervisorlaunchtype`) or
          re.regex($e.target.process.command_line, `(?i)hypervisordebugtype`) or
          re.regex($e.target.process.command_line, `(?i)hypervisorloadoptions`) or
          re.regex($e.target.process.command_line, `(?i)hypervisordebugport`) or
          re.regex($e.target.process.command_line, `(?i)hypervisorbaudrate`) or
          re.regex($e.target.process.command_line, `(?i)testsigning\s+on`) or
          re.regex($e.target.process.command_line, `(?i)nointegritychecks\s+on`) or
          re.regex($e.target.process.command_line, `(?i)loadoptions.*hypervisor`)
        )
      ) or
      // Branch 2: Hypervisor driver file dropped to system directories
      (
        $e.metadata.event_type = "FILE_CREATION"
        and (
          re.regex($e.target.file.full_path, `(?i)\\(system32|syswow64)\\drivers\\`) or
          re.regex($e.target.file.full_path, `(?i)\\EFI\\`) or
          re.regex($e.target.file.full_path, `(?i)\\Boot\\.`)
        )
        and (
          re.regex($e.target.file.full_path, `(?i)(xen\.sys|xenbus\.sys|xennet\.sys|xenvbd\.sys|xenvif\.sys)`) or
          re.regex($e.target.file.full_path, `(?i)(hvax64\.exe|hvix64\.exe|hvloader\.exe|winhvr\.sys)`)
        )
      ) or
      // Branch 3: Registry service key created for hypervisor driver
      (
        $e.metadata.event_type = "REGISTRY_CREATION"
        and re.regex($e.target.registry.registry_key, `(?i)CurrentControlSet\\Services`)
        and (
          re.regex($e.target.registry.registry_key, `(?i)(xen|hvloader|bluepill|subvirt|hypervisor)`) or
          re.regex($e.target.registry.registry_value_data, `(?i)(xen\.sys|xenbus\.sys|hvloader|bluepill|subvirt|vmm\.exe)`)
        )
      ) or
      // Branch 4: EFI or boot sector file modified by untrusted process
      (
        $e.metadata.event_type = "FILE_MODIFICATION"
        and (
          re.regex($e.target.file.full_path, `(?i)\\EFI\\(Microsoft|Boot)\\`) or
          re.regex($e.target.file.full_path, `(?i)(bootmgfw\.efi|bootmgr|\\Boot\\BCD)`)
        )
        and not re.regex($e.principal.process.file.full_path, `(?i)(TrustedInstaller\.exe|wuauclt\.exe|svchost\.exe|MoUsoCoreWorker\.exe|WaaSMedicAgent\.exe)`)
      ) or
      // Branch 5: Suspicious kernel driver load matching hypervisor names
      (
        $e.metadata.event_type = "DRIVER_LOAD"
        and (
          re.regex($e.target.file.full_path, `(?i)(xen\.sys|xenbus\.sys|xenvbd\.sys|winhvr\.sys|hvax64\.exe|bluepill)`) or
          re.regex($e.target.file.full_path, `(?i)(hvix64\.exe|hvloader\.exe|subvirt)`)
        )
      )
    )

  condition:
    $e
}