Skip to content
Threat Feed

Product

QEMU

1 brief RSS
high advisory

Suspicious QEMU Execution on Windows

Detects the execution of QEMU with the -nographic flag and an image file on Windows systems, a technique used for persistence and initial access by installing a rogue Linux virtual machine.

Splunk Enterprise +3 qemu virtualization persistence linux windows
2r 2t