Detect Hypervisor in Splunk
Adversaries may install a type-1 hypervisor below the operating system to achieve persistent, stealthy access that survives reboots and is hidden from the guest OS. A malicious hypervisor intercepts hardware-level operations and can conceal its presence from all software running above it, including security tools and the OS kernel. This technique has been deprecated by MITRE ATT&CK but remains relevant for detection engineering due to its theoretical use by sophisticated threat actors and nation-state groups targeting high-value environments. Practical implementations include Blue Pill-style subvirt attacks, malicious Xen-based hypervisors, or abuse of legitimate hypervisor platforms (Hyper-V, VMware) as persistence anchors. Detection relies on pre-installation indicators (hypervisor binary drops, boot configuration changes, driver installs) since post-installation detection from inside the guest OS is unreliable.
MITRE ATT&CK
- Tactic
- Persistence
- Canonical reference
- https://attack.mitre.org/techniques/T1062/
SPL Detection Query
index=wineventlog (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" OR sourcetype="WinEventLog:Security" OR sourcetype="WinEventLog:System")
| eval DetectionBranch=null(), RiskIndicator=null()
```Branch 1: bcdedit modifying hypervisor boot settings (Sysmon EventCode=1)```
| eval DetectionBranch=if(EventCode=1 AND match(lower(CommandLine), "bcdedit") AND match(lower(CommandLine), "(hypervisorlaunchtype|hypervisordebugtype|hypervisorloadoptions|testsigning|nointegritychecks|hypervisordebugport|hypervisorbaudrate)"), "BcdeditHypervisorConfig", DetectionBranch)
| eval RiskIndicator=if(DetectionBranch="BcdeditHypervisorConfig", "Boot configuration modified to enable or configure hypervisor", RiskIndicator)
```Branch 2: Hypervisor driver dropped to system paths (Sysmon EventCode=11)```
| eval DetectionBranch=if(EventCode=11 AND match(lower(TargetFilename), "(xen\.sys|xenbus\.sys|xennet\.sys|xenvbd\.sys|winhvr\.sys|hvax64\.exe|hvix64\.exe|hvloader\.exe)") AND match(lower(TargetFilename), "(system32\\drivers|syswow64\\drivers|\\efi\\|\\boot\\)"), "HypervisorDriverDrop", DetectionBranch)
| eval RiskIndicator=if(DetectionBranch="HypervisorDriverDrop", "Hypervisor-associated driver written to privileged system directory", RiskIndicator)
```Branch 3: Hypervisor service registered in registry (Sysmon EventCode=13)```
| eval DetectionBranch=if(EventCode=13 AND match(lower(TargetObject), "currentcontrolset\\services") AND match(lower(Details), "(xen\.sys|xenbus\.sys|hvloader|bluePill|subvirt)"), "HypervisorServiceInstall", DetectionBranch)
| eval RiskIndicator=if(DetectionBranch="HypervisorServiceInstall", "Registry service entry created for hypervisor driver", RiskIndicator)
```Branch 4: Suspicious driver loaded (Sysmon EventCode=6)```
| eval DetectionBranch=if(EventCode=6 AND match(lower(ImageLoaded), "(xen\.sys|xenbus\.sys|winhvr\.sys|hvax64\.exe|bluePill)"), "SuspiciousDriverLoad", DetectionBranch)
| eval RiskIndicator=if(DetectionBranch="SuspiciousDriverLoad", "Known hypervisor-associated driver loaded into kernel", RiskIndicator)
```Branch 5: Service install via Security log (EventCode=7045)```
| eval DetectionBranch=if(EventCode=7045 AND match(lower(ServiceFileName), "(xen|hvloader|bluePill|subvirt|vmm\.exe)"), "HypervisorServiceSecurity", DetectionBranch)
| eval RiskIndicator=if(DetectionBranch="HypervisorServiceSecurity", "New kernel service installed matching hypervisor binary names", RiskIndicator)
| where isnotnull(DetectionBranch)
| eval actor=coalesce(User, SubjectUserName, "unknown")
| table _time, host, actor, DetectionBranch, RiskIndicator, CommandLine, TargetFilename, TargetObject, Details, ImageLoaded, ServiceFileName, Image, ParentImage
| sort - _timeMulti-branch Splunk detection for hypervisor-based persistence covering: bcdedit hypervisor configuration changes (Sysmon Event ID 1), hypervisor driver file creation in privileged paths (Sysmon Event ID 11), hypervisor service registry entries (Sysmon Event ID 13), suspicious kernel driver loads matching known hypervisor binaries (Sysmon Event ID 6), and new kernel service installations via Security Event ID 7045. Each event is tagged with a detection branch and risk indicator for analyst triage. Confidence is intentionally low due to the deprecated and extremely rare nature of this technique, with significant overlap with legitimate virtualization software.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Enabling Hyper-V or Windows Hypervisor Platform via Windows Features triggers bcdedit hypervisorlaunchtype changes
- VMware, VirtualBox, Citrix, or Parallels installing PV (paravirtualization) drivers including Xen-compatible components
- WSL2 or Windows Subsystem for Android enabling Hyper-V via bcdedit during first activation
- Enterprise VDI agents (Citrix Virtual Apps, Nutanix) that install Xen PV network and storage drivers to System32\drivers
- Windows Update modifying BCD store and EFI files during feature updates or recovery environment maintenance
Other platforms for T1062
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Enable Hyper-V Hypervisor via bcdedit (Boot Configuration Change)
Expected signal: Sysmon Event ID 1: Process Create with Image=bcdedit.exe, CommandLine containing '/set hypervisorlaunchtype auto'. Security Event ID 4688 (if command line auditing enabled). Parent process will be the test runner (cmd.exe or PowerShell).
- Test 2Disable Driver Signature Enforcement via bcdedit (Prerequisite for Unsigned Hypervisor)
Expected signal: Sysmon Event ID 1: Process Create with Image=bcdedit.exe, CommandLine='bcdedit /set nointegritychecks on'. Security Event ID 4688 with same command. Microsoft-Windows-CodeIntegrity/Operational may log subsequent policy change at next boot.
- Test 3Create Fake Hypervisor Driver Service Registry Entry
Expected signal: Security Event ID 7045 (Service Control Manager: new service installed) with ServiceName=ArgusTestHV, ServiceType=kernel driver, StartType=boot start, ServiceFileName=C:\Windows\System32\drivers\argus_hv_test.sys. Sysmon Event ID 13 (Registry value set) for HKLM\SYSTEM\CurrentControlSet\Services\ArgusTestHV entries including ImagePath, Start (value 0 = boot), and Type.
- Test 4Drop Suspicious Driver File to System32\drivers (Staging Simulation)
Expected signal: Sysmon Event ID 11 (File Create) with TargetFilename=C:\Windows\System32\drivers\xentest.sys and Image=cmd.exe or powershell.exe. The file will be created but is a renamed benign executable — SHA256 will match notepad.exe.
- Test 5Enable Test Signing Mode (Unsigned Driver Loading Prerequisite)
Expected signal: Sysmon Event ID 1: Process Create with Image=bcdedit.exe, CommandLine='bcdedit /set testsigning on'. Security Event ID 4688 with same content. Windows boot splash screen will show 'Test Mode' watermark after next reboot. Microsoft-Windows-CodeIntegrity/Operational logs policy change.
References (10)
- https://attack.mitre.org/techniques/T1062/
- https://en.wikipedia.org/wiki/Hypervisor
- https://capec.mitre.org/data/definitions/552.html
- http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.90.8832&rep=rep1&type=pdf
- https://learn.microsoft.com/en-us/windows-hardware/drivers/install/kernel-mode-code-signing-requirements--windows-vista-and-later-
- https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/bcdedit-command-line-options
- https://docs.microsoft.com/en-us/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity
- https://learn.microsoft.com/en-us/windows/security/hardware-security/tpm/trusted-platform-module-overview
- https://github.com/tandasat/HyperPlatform
- https://github.com/ionescu007/SimpleVisor
Unlock Pro Content
Get the full detection package for T1062 including response playbook, investigation guide, and atomic red team tests.