VirtualBox or VMware VM started headless from the command line

Siemphony@siemphonymediumT1564.006unverified

Matches the Windows leg of AN0909: a Sysmon process creation for `VBoxManage.exe` whose command line names `startvm` together with `headless`, a direct launch of `VBoxHeadless.exe`, or `vmrun.exe` carrying `nogui`. These are the concrete headless-launch mechanisms AN0909 names for VirtualBox and VMware — running a virtual instance with no console window so its contents never reach a screen a user or an EDR's screen-capture telemetry would see, the technique CyberCX documented Akira ransomware using to encrypt files from inside a VirtualBox guest while the host's own AV watched an empty process tree. `vmware-vmx.exe` and `vmwp.exe`, the two other binaries AN0909 names, are deliberately left out: `vmware-vmx.exe` is the VM's own worker process and runs on every VMware-hosted VM whether launched from the GUI or the command line, so nothing on its own process-creation event separates a headless launch from an ordinary one without joining to its parent; `vmwp.exe` is Hyper-V's per-VM worker, spawned by the `vmms.exe` service rather than a command line, and Hyper-V has no GUI-suppression flag to alert on since it is headless by design. MITRE's VirtualizationBinaryWhitelist knob is the intended place to record an estate's own CI runners and lab hosts; no values for it are supplied here. What this rule cannot see is a VM started headless through the VirtualBox or VMware GUI's own "headless mode" menu option rather than the CLI, since that never produces a matching command line. Requires Sysmon with process creation logging enabled; this is not native Windows telemetry and is absent without the Sysmon driver installed and configured to capture EventID 1. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0321, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath endswith "\\VBoxManage.exe" and (ProcessCommandLine contains "startvm" and ProcessCommandLine contains "headless")) or FolderPath endswith "\\VBoxHeadless.exe" or (FolderPath endswith "\\vmrun.exe" and ProcessCommandLine contains "nogui"))

Splunk · SPL

Run this as a search.

index=* ((Image="*\\VBoxManage.exe" AND (CommandLine="*startvm*" AND CommandLine="*headless*")) OR Image="*\\VBoxHeadless.exe" OR (Image="*\\vmrun.exe" AND CommandLine="*nogui*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*\\\\vboxmanage.exe" AND (TO_LOWER(process.command_line) LIKE "*startvm*" AND TO_LOWER(process.command_line) LIKE "*headless*")) OR TO_LOWER(process.executable) LIKE "*\\\\vboxheadless.exe" OR (TO_LOWER(process.executable) LIKE "*\\\\vmrun.exe" AND TO_LOWER(process.command_line) LIKE "*nogui*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 3 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\VBoxManage\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)(?=.*(?:startvm))(?=.*(?:headless)).*</field>    <description>VirtualBox or VMware VM started headless from the command line (1/3)</description>    <mitre>      <id>T1564.006</id>    </mitre>  </rule>   <rule id="100001" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\VBoxHeadless\.exe$</field>    <description>VirtualBox or VMware VM started headless from the command line (2/3)</description>    <mitre>      <id>T1564.006</id>    </mitre>  </rule>   <rule id="100002" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\vmrun\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)nogui</field>    <description>VirtualBox or VMware VM started headless from the command line (3/3)</description>    <mitre>      <id>T1564.006</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: hide_artifacts
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: a81d78ee-54ef-42ff-bbd3-10f8e430eacd

ATT&CKT1564.006

T1564.006Run Virtual Instance

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonhide artifacts

hide artifactsAI draft — unreviewed

01 · What this rule detects

This rule matches the Windows leg of AN0909 in MITRE's Hidden Virtual Instance detection strategy (DET0321): a Sysmon process creation for VBoxManage.exe whose command line names both startvm and headless, a direct launch of VBoxHeadless.exe, or vmrun.exe carrying nogui. Each is a concrete way to start a VirtualBox or VMware guest with no console window, so activity inside it never reaches a screen a user or an EDR's screen-capture telemetry would see — the mechanism CyberCX documented Akira ransomware using to encrypt files from inside a VirtualBox guest while the host's own AV watched an empty process tree.

02 · Telemetry you need

Sysmon EventID 1 (process creation) on Windows, which is not native Windows telemetry — it requires the Sysmon driver installed and configured. Only AN0909's process-creation leg is implemented; its service-creation (System 7045) and registry (Security 4657) log sources are not used. AN0910 (Linux QEMU/KVM/VirtualBox) and AN0911 (macOS Parallels/Fusion/VirtualBox) are separate analytics in the same brief and are out of scope for this rule.

03 · How the logic works

Three independent selections, ORed by 1 of selection*. selection_vboxmanage_headless requires Image to end in \VBoxManage.exe and the command line to contain both startvm and headless — either alone is not enough, since VBoxManage has many subcommands and headless can appear in unrelated arguments. selection_vboxheadless fires on any launch of VBoxHeadless.exe by image name alone, since that binary's entire purpose is running a VM with no GUI. selection_vmrun_nogui requires vmrun.exe plus nogui on the command line. Two of AN0909's three named binaries are deliberately left out: vmware-vmx.exe is the VM's own worker process and runs identically whether the VM was launched from the GUI or the command line, so nothing on its own process-creation event distinguishes a headless launch; vmwp.exe is Hyper-V's per-VM worker, spawned by the vmms.exe service rather than a command line, and Hyper-V has no GUI-suppression flag to alert on since it is headless by design.

04 · Common false positives

The top false positive is not an edge case: CI/CD build and test runners provision VirtualBox VMs headless as a matter of course, and Vagrant's default VBoxManage startvm ... --type headless fires on every vagrant up against a VirtualBox provider — the routine, default path on any estate with developer or CI Vagrant usage, not a rare exception. VMware Workstation or Fusion automation using vmrun ... nogui for scripted QA labs, snapshot testing or scheduled regression runs is the second source. Self-hosted VM farms and malware-analysis sandboxes running VBoxHeadless directly as a background service are the third. What the rule cannot see at all: a VM started headless through the VirtualBox or VMware GUI's own "headless mode" menu option, since that path produces no matching command line.

05 · Detection maturity

tier_1: This rule has never been run against a log line. It sits at the lowest DeBMM maturity tier — authored, unexecuted, unvalidated — until it is run against real Sysmon data, its false-positive volume against actual Vagrant/CI traffic is measured, and VirtualizationBinaryWhitelist is populated from that measurement.

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

MITRE's VirtualizationBinaryWhitelist knob is the intended place to exclude an estate's known CI runners, build hosts and sandbox machines; this rule supplies no values for it. On an estate with heavy Vagrant or CI usage, level: medium is worth revisiting downward, or paired with a populated allowlist before the rule is trusted for anything beyond scaffolding — a reviewer flagged that the loudest false positive here is closer to "everyday default behavior" than to a genuine edge case, which pulls the calibration toward low rather than medium on those estates. MITRE's TimeWindow knob, for correlating registry and service-creation events with the process start, is also unused since this rule only implements the process-creation leg.

Declared by the author

CI/CD build and test runners that provision VirtualBox VMs headless as a matter of course, including Vagrant's default VBoxManage startvm ... --type headless invocation on every vagrant up against a VirtualBox provider.
VMware Workstation or Fusion automation scripts using vmrun ... nogui to start VMs unattended for scripted QA labs, snapshot testing or scheduled regression runs.
Self-hosted VM farms and malware-analysis sandboxes that run VBoxHeadless directly as a background service so many guest VMs can run on one host without a console per VM.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1564.006, evaluated against their process_creation events.

Share this rule

/u/siemphony/a81d78ee-54ef-42ff-bbd3-10f8e430eacd

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

VirtualBox or VMware VM started headless from the command line

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it