Virtualization for Defense Evasion: Hiding Tracks

This report explains how threat actors use host-hosted virtualization (particularly Type 2 hypervisors) to evade detection by creating and operating guest virtual machines on compromised endpoints. It covers the attack chain—image download/ingress, hypervisor installation, VM configuration and control, and VM-originated C2—provides observable indicators (e.g., unusual image downloads, hypervisor installer artifacts, process attribution of network traffic), and recommends hunting, baselining virtualization usage, and blocking unauthorized hypervisors as mitigations.