Detect Hypervisor in Elastic Security
Adversaries may install a type-1 hypervisor below the operating system to achieve persistent, stealthy access that survives reboots and is hidden from the guest OS. A malicious hypervisor intercepts hardware-level operations and can conceal its presence from all software running above it, including security tools and the OS kernel. This technique has been deprecated by MITRE ATT&CK but remains relevant for detection engineering due to its theoretical use by sophisticated threat actors and nation-state groups targeting high-value environments. Practical implementations include Blue Pill-style subvirt attacks, malicious Xen-based hypervisors, or abuse of legitimate hypervisor platforms (Hyper-V, VMware) as persistence anchors. Detection relies on pre-installation indicators (hypervisor binary drops, boot configuration changes, driver installs) since post-installation detection from inside the guest OS is unreliable.
MITRE ATT&CK
- Tactic
- Persistence
- Canonical reference
- https://attack.mitre.org/techniques/T1062/
Elastic Detection Query
any where
(
/* Branch 1: bcdedit modifying hypervisor boot settings */
(
event.category == "process" and event.type == "start" and
process.name : "bcdedit.exe" and
process.args : ("*hypervisorlaunchtype*", "*hypervisordebugtype*", "*hypervisordebugport*", "*hypervisorbaudrate*", "*hypervisorloadoptions*", "*hypervisorschedulertype*", "*testsigning*", "*nointegritychecks*", "*loadoptions*hypervisor*")
) or
/* Branch 2: Hypervisor driver dropped to privileged system paths */
(
event.category == "file" and event.type in ("creation", "change") and
file.path : ("*\\System32\\drivers\\*", "*\\SysWOW64\\drivers\\*", "*\\EFI\\*", "*\\Boot\\*") and
file.name : ("xen.sys", "xenbus.sys", "xennet.sys", "xenvbd.sys", "xenvif.sys", "hvax64.exe", "hvix64.exe", "hvloader.exe", "winhvr.sys", "hvload*")
) or
/* Branch 3: Hypervisor service registered via registry */
(
event.category == "registry" and event.type in ("creation", "change") and
registry.path : "*\\SYSTEM\\CurrentControlSet\\Services\\*" and
(
registry.data.strings : ("*xen.sys*", "*xenbus.sys*", "*hvloader*", "*bluePill*", "*subvirt*", "*vmm.exe*") or
registry.key : ("*xen*", "*bluePill*", "*subvirt*", "*hvloader*", "*hypervisor*")
)
) or
/* Branch 4: Suspicious hypervisor-associated driver loaded into kernel */
(
event.category == "driver" and
file.name : ("xen.sys", "xenbus.sys", "xenvbd.sys", "winhvr.sys", "hvax64.exe", "hvix64.exe", "bluepill*")
) or
/* Branch 5: EFI or boot sector file modified by untrusted process */
(
event.category == "file" and event.type in ("creation", "change", "rename") and
file.path : ("*\\EFI\\Microsoft\\Boot\\*", "*\\EFI\\Boot\\*", "*\\Boot\\BCD*", "*bootmgfw.efi*", "*bootmgr*") and
not process.name : ("TrustedInstaller.exe", "wuauclt.exe", "svchost.exe", "MoUsoCoreWorker.exe", "WaaSMedicAgent.exe")
)
)Detects T1062 Hypervisor installation pre-indicators across five detection branches: bcdedit boot configuration changes enabling hypervisor loading, hypervisor-associated driver files dropped to system directories, registry service entries for known hypervisor drivers, kernel driver load events for hypervisor binaries, and EFI/boot sector modification by untrusted processes.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate Hyper-V or WSL2 installation and configuration by system administrators using bcdedit to set hypervisorlaunchtype or testsigning for development environments.
- Xen or VMware Tools installation on a legitimate server virtualization host where Xen paravirtualization drivers (xen.sys, xenbus.sys) are expected kernel components.
- Windows Boot Manager updates during major OS upgrades or Windows Update patch cycles modifying EFI boot files via TrustedInstaller or MoUsoCoreWorker — ensure process exclusions are kept current.
- Security researchers or penetration testers running Blue Pill or SubVirt proof-of-concept tools in authorized lab environments.
- Backup and disaster recovery solutions (e.g., Veeam, Acronis) that interact with EFI partitions and BCD stores during bare-metal restore operations.
Other platforms for T1062
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Enable Hyper-V Hypervisor via bcdedit (Boot Configuration Change)
Expected signal: Sysmon Event ID 1: Process Create with Image=bcdedit.exe, CommandLine containing '/set hypervisorlaunchtype auto'. Security Event ID 4688 (if command line auditing enabled). Parent process will be the test runner (cmd.exe or PowerShell).
- Test 2Disable Driver Signature Enforcement via bcdedit (Prerequisite for Unsigned Hypervisor)
Expected signal: Sysmon Event ID 1: Process Create with Image=bcdedit.exe, CommandLine='bcdedit /set nointegritychecks on'. Security Event ID 4688 with same command. Microsoft-Windows-CodeIntegrity/Operational may log subsequent policy change at next boot.
- Test 3Create Fake Hypervisor Driver Service Registry Entry
Expected signal: Security Event ID 7045 (Service Control Manager: new service installed) with ServiceName=ArgusTestHV, ServiceType=kernel driver, StartType=boot start, ServiceFileName=C:\Windows\System32\drivers\argus_hv_test.sys. Sysmon Event ID 13 (Registry value set) for HKLM\SYSTEM\CurrentControlSet\Services\ArgusTestHV entries including ImagePath, Start (value 0 = boot), and Type.
- Test 4Drop Suspicious Driver File to System32\drivers (Staging Simulation)
Expected signal: Sysmon Event ID 11 (File Create) with TargetFilename=C:\Windows\System32\drivers\xentest.sys and Image=cmd.exe or powershell.exe. The file will be created but is a renamed benign executable — SHA256 will match notepad.exe.
- Test 5Enable Test Signing Mode (Unsigned Driver Loading Prerequisite)
Expected signal: Sysmon Event ID 1: Process Create with Image=bcdedit.exe, CommandLine='bcdedit /set testsigning on'. Security Event ID 4688 with same content. Windows boot splash screen will show 'Test Mode' watermark after next reboot. Microsoft-Windows-CodeIntegrity/Operational logs policy change.
References (10)
- https://attack.mitre.org/techniques/T1062/
- https://en.wikipedia.org/wiki/Hypervisor
- https://capec.mitre.org/data/definitions/552.html
- http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.90.8832&rep=rep1&type=pdf
- https://learn.microsoft.com/en-us/windows-hardware/drivers/install/kernel-mode-code-signing-requirements--windows-vista-and-later-
- https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/bcdedit-command-line-options
- https://docs.microsoft.com/en-us/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity
- https://learn.microsoft.com/en-us/windows/security/hardware-security/tpm/trusted-platform-module-overview
- https://github.com/tandasat/HyperPlatform
- https://github.com/ionescu007/SimpleVisor
Unlock Pro Content
Get the full detection package for T1062 including response playbook, investigation guide, and atomic red team tests.