Detect Hypervisor in Sumo Logic CSE
Adversaries may install a type-1 hypervisor below the operating system to achieve persistent, stealthy access that survives reboots and is hidden from the guest OS. A malicious hypervisor intercepts hardware-level operations and can conceal its presence from all software running above it, including security tools and the OS kernel. This technique has been deprecated by MITRE ATT&CK but remains relevant for detection engineering due to its theoretical use by sophisticated threat actors and nation-state groups targeting high-value environments. Practical implementations include Blue Pill-style subvirt attacks, malicious Xen-based hypervisors, or abuse of legitimate hypervisor platforms (Hyper-V, VMware) as persistence anchors. Detection relies on pre-installation indicators (hypervisor binary drops, boot configuration changes, driver installs) since post-installation detection from inside the guest OS is unreliable.
MITRE ATT&CK
- Tactic
- Persistence
- Canonical reference
- https://attack.mitre.org/techniques/T1062/
Sumo Detection Query
_sourceCategory=windows/sysmon OR _sourceCategory=windows/security OR _sourceCategory=windows/system
| parse field=_raw "<EventID>*</EventID>" as EventID nodrop
| parse field=_raw "<Data Name='CommandLine'>*</Data>" as CommandLine nodrop
| parse field=_raw "<Data Name='Image'>*</Data>" as Image nodrop
| parse field=_raw "<Data Name='ParentImage'>*</Data>" as ParentImage nodrop
| parse field=_raw "<Data Name='TargetFilename'>*</Data>" as TargetFilename nodrop
| parse field=_raw "<Data Name='TargetObject'>*</Data>" as TargetObject nodrop
| parse field=_raw "<Data Name='Details'>*</Data>" as RegistryDetails nodrop
| parse field=_raw "<Data Name='ImageLoaded'>*</Data>" as ImageLoaded nodrop
| parse field=_raw "<Data Name='ServiceFileName'>*</Data>" as ServiceFileName nodrop
| parse field=_raw "<Data Name='User'>*</Data>" as User nodrop
| parse field=_raw "<Data Name='Computer'>*</Data>" as Computer nodrop
// Branch 1: bcdedit hypervisor boot config changes (Sysmon EID 1)
| eval DetectionBranch = if(
EventID = "1"
AND matches(toLowerCase(CommandLine), ".*bcdedit.*")
AND matches(toLowerCase(CommandLine), ".*(hypervisorlaunchtype|hypervisordebugtype|hypervisorloadoptions|hypervisordebugport|hypervisorbaudrate|testsigning|nointegritychecks|hypervisorschedulertype).*"),
"BcdeditHypervisorConfig", null)
| eval RiskIndicator = if(DetectionBranch = "BcdeditHypervisorConfig",
"Boot configuration modified to enable or configure hypervisor loading", null)
// Branch 2: Hypervisor driver written to system paths (Sysmon EID 11)
| eval DetectionBranch = if(isnull(DetectionBranch)
AND EventID = "11"
AND matches(toLowerCase(TargetFilename), ".*(xen\.sys|xenbus\.sys|xennet\.sys|xenvbd\.sys|xenvif\.sys|hvax64\.exe|hvix64\.exe|hvloader\.exe|winhvr\.sys).*")
AND matches(toLowerCase(TargetFilename), ".*(system32\\\\drivers|syswow64\\\\drivers|\\\\efi\\\\|\\\\boot\\\\).*"),
"HypervisorDriverDrop", DetectionBranch)
| eval RiskIndicator = if(DetectionBranch = "HypervisorDriverDrop",
"Hypervisor-associated driver written to privileged system directory", RiskIndicator)
// Branch 3: Registry service entry for hypervisor driver (Sysmon EID 13)
| eval DetectionBranch = if(isnull(DetectionBranch)
AND EventID = "13"
AND matches(toLowerCase(TargetObject), ".*currentcontrolset\\\\services.*")
AND matches(toLowerCase(RegistryDetails), ".*(xen\.sys|xenbus\.sys|hvloader|bluepill|subvirt|vmm\.exe).*"),
"HypervisorServiceInstall", DetectionBranch)
| eval RiskIndicator = if(DetectionBranch = "HypervisorServiceInstall",
"Registry service entry created for hypervisor driver binary", RiskIndicator)
// Branch 4: Known hypervisor driver loaded into kernel (Sysmon EID 6)
| eval DetectionBranch = if(isnull(DetectionBranch)
AND EventID = "6"
AND matches(toLowerCase(ImageLoaded), ".*(xen\.sys|xenbus\.sys|xenvbd\.sys|winhvr\.sys|hvax64\.exe|bluepill).*"),
"SuspiciousDriverLoad", DetectionBranch)
| eval RiskIndicator = if(DetectionBranch = "SuspiciousDriverLoad",
"Known hypervisor-associated driver loaded into kernel address space", RiskIndicator)
// Branch 5: New service install with hypervisor binary names (Security EID 7045)
| eval DetectionBranch = if(isnull(DetectionBranch)
AND EventID = "7045"
AND matches(toLowerCase(ServiceFileName), ".*(xen|hvloader|bluepill|subvirt|vmm\.exe|hv\.exe).*"),
"HypervisorServiceSecurity", DetectionBranch)
| eval RiskIndicator = if(DetectionBranch = "HypervisorServiceSecurity",
"New kernel service installed matching hypervisor binary name patterns", RiskIndicator)
| where !isnull(DetectionBranch)
| fields _messagetime, Computer, User, EventID, DetectionBranch, RiskIndicator, CommandLine, Image, ParentImage, TargetFilename, TargetObject, RegistryDetails, ImageLoaded, ServiceFileName
| sort by _messagetime descSumo Logic query detecting T1062 Hypervisor pre-installation indicators from Windows Sysmon and Security event logs. Parses XML event fields to identify bcdedit hypervisor boot configuration changes, hypervisor driver drops to system directories, registry service entries for known hypervisor binaries, suspicious kernel driver loads, and new service registration with hypervisor binary names.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate Hyper-V feature installation or update on Windows Server or Windows 10/11 Pro hosts triggers winhvr.sys driver registration and bcdedit hypervisorlaunchtype configuration changes through Windows Modules Installer.
- AWS, Azure, or GCP Windows virtual machine instances where cloud provider PV/VirtIO drivers matching xen* naming patterns are installed or updated by cloud management agents.
- Enterprise virtualization platform upgrades (VMware vCenter agent updates, Citrix XenServer tools) that modify boot configuration or register new kernel services with hypervisor-associated driver names.
- Security product driver installations (EDR agents, AV kernel components) that interact with boot configuration as part of self-protection mechanisms may trigger bcdedit-related branches.
Other platforms for T1062
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Enable Hyper-V Hypervisor via bcdedit (Boot Configuration Change)
Expected signal: Sysmon Event ID 1: Process Create with Image=bcdedit.exe, CommandLine containing '/set hypervisorlaunchtype auto'. Security Event ID 4688 (if command line auditing enabled). Parent process will be the test runner (cmd.exe or PowerShell).
- Test 2Disable Driver Signature Enforcement via bcdedit (Prerequisite for Unsigned Hypervisor)
Expected signal: Sysmon Event ID 1: Process Create with Image=bcdedit.exe, CommandLine='bcdedit /set nointegritychecks on'. Security Event ID 4688 with same command. Microsoft-Windows-CodeIntegrity/Operational may log subsequent policy change at next boot.
- Test 3Create Fake Hypervisor Driver Service Registry Entry
Expected signal: Security Event ID 7045 (Service Control Manager: new service installed) with ServiceName=ArgusTestHV, ServiceType=kernel driver, StartType=boot start, ServiceFileName=C:\Windows\System32\drivers\argus_hv_test.sys. Sysmon Event ID 13 (Registry value set) for HKLM\SYSTEM\CurrentControlSet\Services\ArgusTestHV entries including ImagePath, Start (value 0 = boot), and Type.
- Test 4Drop Suspicious Driver File to System32\drivers (Staging Simulation)
Expected signal: Sysmon Event ID 11 (File Create) with TargetFilename=C:\Windows\System32\drivers\xentest.sys and Image=cmd.exe or powershell.exe. The file will be created but is a renamed benign executable — SHA256 will match notepad.exe.
- Test 5Enable Test Signing Mode (Unsigned Driver Loading Prerequisite)
Expected signal: Sysmon Event ID 1: Process Create with Image=bcdedit.exe, CommandLine='bcdedit /set testsigning on'. Security Event ID 4688 with same content. Windows boot splash screen will show 'Test Mode' watermark after next reboot. Microsoft-Windows-CodeIntegrity/Operational logs policy change.
References (10)
- https://attack.mitre.org/techniques/T1062/
- https://en.wikipedia.org/wiki/Hypervisor
- https://capec.mitre.org/data/definitions/552.html
- http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.90.8832&rep=rep1&type=pdf
- https://learn.microsoft.com/en-us/windows-hardware/drivers/install/kernel-mode-code-signing-requirements--windows-vista-and-later-
- https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/bcdedit-command-line-options
- https://docs.microsoft.com/en-us/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity
- https://learn.microsoft.com/en-us/windows/security/hardware-security/tpm/trusted-platform-module-overview
- https://github.com/tandasat/HyperPlatform
- https://github.com/ionescu007/SimpleVisor
Unlock Pro Content
Get the full detection package for T1062 including response playbook, investigation guide, and atomic red team tests.