QEMU Hidden-VM Evasion — STAC4713 / STAC3725

Threat actors (Sophos clusters STAC4713 and STAC3725) deploy a portable QEMU hypervisor on a compromised Windows host and run a hidden virtual machine — a lightweight Linux/backdoor guest that proxies C2 and runs tooling outside the host EDR's visibility. The same VM-as-evasion playbook cross-links the PayoutsKing activity. Defensive hunt & harden pack — no offensive code.

Threat

QEMU hidden-VM evasion · STAC4713 / STAC3725

Severity

HIGH · EDR-BLINDSPOT TECHNIQUE

Type

Defense evasion · rogue hypervisor · C2 proxy

Tooling

Portable QEMU (qemu-system-*.exe) + guest image

Cross-link

PayoutsKing (same hidden-VM playbook)

Version

v0.3 · 2026-06-12

Author

HuntPack

Executive Summary

Sophos tracks intrusion clusters (STAC4713, STAC3725) in which attackers smuggle a portable QEMU emulator onto a compromised Windows host and boot a small hidden virtual machine (commonly a minimal Linux guest). The host EDR sees only a legitimate, signed-ish qemu-system-x86_64.exe process and some network activity — it cannot see inside the guest, where the actual C2 client, tunneling tools, and post-exploitation tooling run. The VM is bridged/NAT'd to the host network so it can proxy C2 and reach internal systems while staying in the endpoint's blind spot.

This is a defense-evasion technique, not a single malware family: the durable indicators are the presence and execution of a portable hypervisor in a place no business process would put one, the large guest disk images (.qcow2/.img/.vmdk), the creation of virtual/TAP network adapters, and persistence that boots the VM. The same "run the implant inside a VM the EDR can't inspect" playbook links this activity to PayoutsKing.

⚠ Defender priority: Most enterprises have no legitimate reason for QEMU on user/server endpoints. Hunt Q1 (qemu-system / qemu-img execution), Q2 (portable QEMU binaries written to a user/temp path), and Q4 (guest disk-image files). Treat any QEMU on a non-developer host as a hidden-VM evasion incident — the EDR is blind to the guest, so respond at the host/network level.

Source Review & Web Hunter Notes

Tier	Source	Key Finding	Carry
1 · Vendor research	Sophos X-Ops — STAC4713 / STAC3725 hidden-VM	Portable QEMU + hidden guest as an EDR blind spot; C2 proxied from inside the VM	yes
2 · Vendor	Prior QEMU-tunneling reporting (Kaspersky et al.)	QEMU used to build covert network tunnels into internal segments	yes
1 · Cross-link	HuntPack — PayoutsKing	Same hidden-VM-for-evasion playbook; shared hunt logic	partial

Decisions: technique-anchored (not a malware hash) — detect the hypervisor itself + its artifacts; assume the guest is opaque to EDR, so hunt the host-visible edges (process, disk images, virtual NICs, persistence) and pivot to network/IR; baseline legitimate virtualization users (developers/IT) to keep FPs low; cross-reference PayoutsKing for shared infra/TTP.

Hunt Brief & Attack Chain

Working hypothesis: After gaining access, the actor drops a portable QEMU package + a guest image, registers persistence, boots a hidden VM bridged to the host network, and runs C2/tooling inside the guest — invisible to the host EDR.

Step	Behavior	Telemetry	Hunt Angle
1 · Access	Exploited service / valid accounts / phishing	auth; edge	N1
2 · Stage QEMU	Portable QEMU + guest image written to a user/temp path	file; `ProcessRollup2`	Q2 / Q4
3 · Boot VM	`qemu-system-*.exe` launches the guest	`ProcessRollup2`	Q1; N2
4 · Virtual NIC	TAP/bridged adapter created for guest networking	driver/adapter; net	Q3; N3
5 · Persistence	Service / Run key / task boots the VM on start	registry; service; task	Q5
6 · C2 proxy	Guest proxies C2 / reaches internal hosts	`NetworkConnectIP4`; netflow	Q6; N4

Affected surface & telemetry

Surface	Required Telemetry	Priority	Gap Risk
Windows endpoints/servers	Process + file-write events	Critical	Low — host-visible edges
Virtual networking	Adapter/driver install + netflow	High	Medium — TAP/bridge visibility
VM interior	(opaque to host EDR)	N/A	High — blind spot by design
Persistence	Service / Run / task	Medium	Low

Consolidated IOC Table

This is a technique — the guest is opaque, so anchor on the host-visible hypervisor artifacts. QEMU binary names, disk images, and virtual NICs are durable; specific hashes/images rotate. Copy-ready blocks in §9.

Type	Value	Conf	Action	Context
Behavior	qemu-system-*.exe / qemu-img.exe execution on a non-dev host	high	detect	Rogue hypervisor — flagship
File	Portable QEMU binaries in a user/temp path	high	hunt	Staging
File	Guest disk images: .qcow2 / .img / .vmdk / .raw	medium	hunt	Hidden guest
Behavior	TAP/bridged virtual NIC created for guest networking	medium	hunt	VM connectivity
Behavior	Service/Run/task booting QEMU at startup	medium	hunt	Persistence

ATT&CK Mapping

Tactic	Technique	Observed Behavior	Query / Control
Defense Evasion	T1564.006 — Run virtual instance	Hidden QEMU guest evades host EDR	Q1, Q4
Execution	T1059 / T1106 — Hypervisor execution	qemu-system launches the guest	Q1; N2
Command & Control	T1572 / T1090 — Tunneling / proxy	Guest bridges/proxies C2 to internal hosts	Q3, Q6; N4
Persistence	T1543.003 / T1547.001 / T1053.005 — Service / Run / task	VM boots at startup	Q5
Ingress Tool Transfer	T1105 — Transfer QEMU + guest image	Portable hypervisor staged to disk	Q2

Native Audit-Log Hunts

Hunt	Source	Logic	Response
N1 · Initial access	Edge/VPN + auth	Exploited service / anomalous logins preceding the QEMU staging	Reset creds; patch edge
N2 · Hypervisor execution	Process creation (Sysmon 1 / Security 4688)	qemu-system / qemu-img / qemu-ga on hosts with no virtualization role	Isolate; IR
N3 · Virtual NIC install	Driver/adapter (Sysmon 6 / System log)	TAP/bridge adapter creation outside sanctioned hypervisor/VPN software	Inspect; pivot to netflow
N4 · VM-proxied egress	Netflow / proxy	Egress + internal lateral traffic sourced from the host's VM adapter/IP	Block; identify guest C2

CrowdStrike LogScale CQL Hunt Queries

Falcon cloud (drives "Open in Falcon"): Pick your tenant's cloud first — every "Open in Falcon" button below uses this selection.

Field names validated against the Falcon event reference; process hunts include SyntheticProcessRollup2. The guest is opaque to the sensor — these hunts target the host-visible hypervisor artifacts. Maintain an allow-list of sanctioned virtualization hosts (developers, IT lab) to suppress FPs.

Q1 · QEMU hypervisor execution

CONF HIGHFP LOWCOST LOW

Looks for: any qemu-system-* / qemu-img / qemu-ga process. Accomplishes: the rogue hypervisor. FP: low on most fleets — allow-list known dev/IT virtualization hosts.

// HUNT: QEMU hypervisor execution (hidden-VM evasion)
// MITRE: T1564.006, T1059 | CONF: high  FP: low  COST: low
// FP NOTES: most endpoints have no QEMU; allow-list sanctioned dev/IT virtualization hosts
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^qemu(-system-[a-z0-9_]+|-img|-ga|-edge)?\.exe$/i
| table([@timestamp, ComputerName, UserName, FileName, ImageFileName, CommandLine], limit=200)

Q2 · Portable QEMU staged to a user/temp path

CONF HIGHFP LOWCOST LOW

Looks for: QEMU binaries written to a user/temp/download path (the portable drop). Accomplishes: staging before boot. FP: low — legit QEMU installs to Program Files.

// HUNT: portable QEMU binaries staged to a user/temp path
// MITRE: T1105, T1564.006 | CONF: high  FP: low  COST: low
// FP NOTES: sanctioned QEMU lives in Program Files; flag user/temp/download dirs
#event_simpleName=/PeFileWritten|NewExecutableWritten/
| TargetFileName=/\\qemu(-system-[a-z0-9_]+|-img|-ga)?\.exe$/i
| TargetFileName=/\\(Temp|AppData|Downloads|Users\\Public|ProgramData)\\/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, TargetFileName, SHA256HashData], limit=200)

Q3 · QEMU guest-networking command line

CONF HIGHFP LOWCOST LOW

Looks for: QEMU launched with networking flags (-netdev, -nic, tap, hostfwd) — the bridge/proxy setup. Accomplishes: confirms a networked hidden guest. FP: low outside dev hosts.

// HUNT: QEMU guest networking (bridge/tap/hostfwd) command line
// MITRE: T1572, T1090 | CONF: high  FP: low  COST: low
// TUNING: -netdev/-nic tap/hostfwd indicates a networked guest; allow-list dev hosts
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^qemu-system-[a-z0-9_]+\.exe$/i
| CommandLine=/(-netdev|-nic|tap,|hostfwd|bridge,|-device.+(net|e1000|virtio-net))/i
| table([@timestamp, ComputerName, UserName, FileName, CommandLine], limit=200)

Q4 · Guest disk-image files

CONF MEDFP MEDCOST LOW

Looks for: QEMU/VM disk images written to disk (.qcow2/.img/.raw/.vmdk), especially in user/temp paths. FP: medium — sanctioned VMs use these; flag non-dev hosts + user paths.

// HUNT: hidden-guest disk-image files
// MITRE: T1564.006 | CONF: medium  FP: medium  COST: low
// TUNING: .qcow2 is QEMU-specific; flag non-dev hosts + user/temp paths
#event_simpleName=/PeFileWritten/
| TargetFileName=/\.(qcow2|img|raw|vmdk)$/i
| TargetFileName=/\\(Temp|AppData|Downloads|Users\\Public|ProgramData)\\/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, TargetFileName], limit=200)

Q5 · Persistence booting QEMU at startup

CONF MED-HIGHFP LOW-MEDCOST LOW

Looks for: a service / Run key / scheduled task whose command references qemu. Accomplishes: the VM auto-boot. FP: low-med — correlate to Q1/Q2.

// HUNT: persistence that boots QEMU at startup
// MITRE: T1543.003, T1547.001, T1053.005 | CONF: med-high  FP: low-med  COST: low
// TUNING: correlate to Q1/Q2; flag user/temp-path qemu references
#event_simpleName=/AsepValueUpdate|ScheduledTaskRegistered|ServiceImagePath|RegSystemConfigValueUpdate/
| RegStringValue=/qemu(-system|-img)?/i
| table([@timestamp, ComputerName, UserName, RegObjectName, RegStringValue, ServiceName], limit=200)

Q6 · QEMU process egress / proxying

CONF MEDFP MEDCOST MED

Looks for: outbound/internal connections attributed to a qemu-system process (the guest proxying C2/lateral). FP: medium — pair with netflow (N4); the guest interior stays opaque.

// HUNT: egress/lateral attributed to a QEMU process
// MITRE: T1572, T1090 | CONF: medium  FP: medium  COST: med
// TUNING: pair with netflow (N4); guest interior is opaque to the sensor
#event_simpleName=NetworkConnectIP4
| ContextImageFileName=/\\qemu-system-[a-z0-9_]+\.exe$/i
| groupBy([ComputerName, RemoteAddressIP4, RemotePort], function=count())
| table([ComputerName, RemoteAddressIP4, RemotePort, _count], limit=200)

CrowdStrike Custom IOA Recommendations

IOA Name	Field Patterns	Benign Exclusions	Deployment Path
QEMU — hypervisor execution	Process `qemu-system-*.exe` / `qemu-img.exe`	Sanctioned dev/IT virtualization hosts (host-group exclusion)	Endpoint Security → Custom IOA → Process Creation, Detect+Block
QEMU — networked guest launch	`qemu-system-*` + `-netdev/-nic tap/hostfwd`	Sanctioned dev hosts	Custom IOA → Process Creation, Detect+Block

Q1 is a near-deterministic promotion on any fleet without sanctioned QEMU. Scope the IOAs to exclude a small, well-defined virtualization host group rather than allowing QEMU everywhere.

Machine-Readable IOC Appendix

Grouped IOC Quick-Copy

One-click blocks for detection. The guest is opaque — anchor on the host-visible hypervisor artifacts. Add per-incident atoms (image hashes, guest C2, virtual MAC/IP) during triage.

Behavioral Signaturesdetection logic

qemu-system-*.exe / qemu-img.exe / qemu-ga.exe executing on a non-virtualization host
Portable QEMU binaries written to %Temp%/%AppData%/Downloads/ProgramData
qemu-system launched with -netdev / -nic tap / hostfwd / bridge (networked guest)
Guest disk image written: .qcow2 / .img / .raw / .vmdk (esp. in user/temp paths)
TAP/bridged virtual NIC created outside sanctioned hypervisor/VPN software
Service / Run key / scheduled task whose command references qemu (VM auto-boot)
Egress + internal lateral traffic sourced from the host's VM adapter/IP

Tooling / AttributionSTAC4713 / STAC3725

Technique: hidden virtual machine via portable QEMU (EDR blind spot)
Clusters: STAC4713, STAC3725 (Sophos X-Ops)
Binaries: qemu-system-x86_64.exe, qemu-system-i386.exe, qemu-img.exe, qemu-ga.exe
Guest images: *.qcow2 (QEMU-native), *.img, *.raw, *.vmdk
# NOT a single malware family -- this is a defense-evasion playbook.
# Cross-links HuntPack: PayoutsKing (same hidden-VM-for-evasion approach)

Why It Evades EDRanalyst note

The host EDR sees only the qemu-system process + its network sockets.
The real C2 client, tunneling tools, and post-ex tooling run INSIDE the guest OS,
which the host sensor cannot inspect. So:
  - Detect the hypervisor + its artifacts at the host edge (Q1-Q5).
  - Pivot to NETWORK telemetry (netflow/proxy) for what the guest is doing (Q6/N4).
  - Treat any unsanctioned QEMU as an active evasion incident; respond host+network.

Hardening / Blockdefense-in-depth

App control (WDAC/AppLocker): block qemu-system/qemu-img except on a defined VM host group
Promote Q1 (QEMU execution) + Q3 (networked guest) to Detect+Block (scoped exclusions)
Block portable-app execution from Downloads/Temp; default-deny user-path EXEs
Alert on TAP/bridge adapter creation outside sanctioned software
Netflow/NDR: watch for new internal pivots from endpoint VM adapters
Patch/harden initial-access vectors; phishing-resistant MFA on remote access

Hardening — Tiered & Deployable

Block the hypervisor where it has no business running, then watch the network the guest hides behind.

Immediate — Block the rogue hypervisor

App control: block qemu-system/qemu-img except on a defined VM-host group — M1038. Removes the technique from the rest of the fleet.
Promote Q1 (QEMU execution) + Q3 (networked guest) to Detect+Block — M1040 (scoped exclusions).
Block portable-app execution from Downloads/Temp — M1038. Stops the staging (Q2).
Alert on TAP/bridge adapter creation outside sanctioned software — M1031.

Near term — Watch the network (pilot first)

Netflow/NDR: detect new internal pivots from endpoint VM adapters — M1030. Covers the opaque guest (N4/Q6).
Inventory + remove unsanctioned virtualization software — M1033. Feeds N2.
Patch/harden initial access; phishing-resistant MFA on remote access — M1032 / M1051.

Strategic — Reduce evasion surface

Application allowlisting fleet-wide; default-deny user-path execution — M1038.
Network segmentation to limit what any pivot can reach — M1030.
NDR coverage so endpoint blind spots are caught on the wire — M1047.

Containment Runbook

Phase	Actions	Owner	Evidence
Isolate	Network-contain the host (the guest is opaque — rely on network controls); preserve the QEMU package + guest image for offline analysis	SOC L2	Containment timestamp; Q1 event; image
Triage	Map staging → boot → networking → persistence; pull netflow for the VM adapter; mount the guest image offline to recover C2/tooling	IR	Process/file timeline; netflow; guest forensics
Eradicate	Remove QEMU + guest image + virtual NIC + persistence; block the guest's C2; reset creds touched on the host	IR	Removal log; cred reset
Recover	Reimage the host (treat as fully compromised — EDR was blind); restore from clean backup	IR + IT	Rebuild ticket
Harden	App control on QEMU; promote Q1/Q3; alert on TAP/bridge adapters; NDR for endpoint pivots	Detection Eng	IOA enabled; NDR rule

Detection Coverage Map & Validation

Technique	Behavior	CQL	IOA	Coverage
T1564.006	QEMU hypervisor execution	Q1	IOA-1	Good + app control
T1105	Portable QEMU staging	Q2	—	Good
T1572 / T1090	Networked guest (bridge/tap)	Q3, Q6	IOA-2	Partial + netflow (N4)
T1564.006	Guest disk image	Q4	—	Partial non-dev hosts
T1543.003 / T1547.001	VM-boot persistence	Q5	—	Good
—	Guest interior (C2/tooling)	—	—	GAP opaque to EDR — use NDR (N4)

Validation gates: (1) confirm process + file-write + netflow telemetry; (2) enumerate sanctioned virtualization host groups (developers/IT) and exclude them; (3) lab-test a benign QEMU launch on an allow-listed host (must NOT alert) and on a normal host (MUST alert Q1); (4) enable app control + promote Q1/Q3; stand up NDR for the guest blind spot. Reminder: the EDR cannot see inside the guest — respond at host + network.

Hunt Summary Ticket

TITLE:        Hunt — QEMU Hidden-VM Evasion (STAC4713 / STAC3725)
SEVERITY:     High (host EDR blind spot; C2 proxied from inside a hidden VM)
SCOPE:        Windows endpoints/servers without a virtualization role; network/NDR
HYPOTHESIS:   Actor stages portable QEMU + a guest image -> boots a hidden VM bridged to the
              host network -> runs C2/tooling inside the guest, invisible to the host sensor.
QUERIES RUN:  Q1 QEMU execution (IOA) | Q2 portable QEMU staging | Q3 networked guest (IOA) |
              Q4 guest disk image | Q5 VM-boot persistence | Q6 QEMU egress/proxy
              + Native N1-N4 (access, hypervisor exec, virtual NIC, VM-proxied egress)
DO FIRST:     App control on QEMU; Q1 -- escalate any unsanctioned QEMU as an evasion incident
FINDINGS:     <pending analyst execution>
GAPS:         Guest interior is opaque to EDR -- cover with NDR/netflow; cross-ref PayoutsKing
ACTIONS:      Block qemu except on a defined VM-host group; promote Q1/Q3; alert on TAP/bridge
              adapters; NDR for endpoint pivots; reimage affected hosts
OWNER:        HuntPack
VERSION:      v0.3 - 2026-06-12

Changelog

v0.52026-07-24CQL correctness pass. All table() calls now carry an explicit row limit: the default is 200 and truncation is silent, so a capped result was indistinguishable from a complete one. Atomic-IOC sweeps (filters over 5+ hashes or C2 IPs) use limit=max so a wide infection is never silently under-scoped; behavioural hunts use limit=200, where exceeding the cap indicates the query needs tuning. Where present, event names that do not exist in the Falcon data model were corrected (e.g. ServiceInstalled is a Sysmon concept, not a Falcon event; ElfFileWritten is ELFFileWritten) — such queries could never return a row. No detection logic, fields, or IOCs changed.

v0.42026-06-29CQL syntax review (crowdstrike-logscale-v3): removed invalid FileCreateInfo/NewFileWritten events (Q4); ImageFileName→ContextImageFileName on network event (Q6).

v0.32026-06-12Re-hunt + reformatted to the review-v2 gold layout (fixed left-sidebar scrollspy TOC, collapsible, cloud selector inside the CQL section, per-card Copy/Open-in-Falcon, Grouped IOC Quick-Copy grid, coverage+validation, .ticket). Refreshed from Sophos X-Ops STAC4713/STAC3725: portable-QEMU hidden-VM as an EDR blind spot, networked guest (bridge/tap/hostfwd), guest disk images, VM-boot persistence, network-pivot detection. Cross-linked to the PayoutsKing pack. 6 CQL + 4 native hunts, 2 IOA candidates; technique-anchored.

v0.12026-05-10Initial pack: QEMU hidden-VM overview + hunts. Pre-gold top-bar layout.

References

Tier	Source	Used For
1	Sophos X-Ops — STAC4713 / STAC3725 hidden-VM evasion	Portable QEMU hidden-VM technique, C2 proxying, clusters
2	MITRE ATT&CK T1564.006 — Run Virtual Instance	Hidden-VM defense-evasion mapping
1	HuntPack — PayoutsKing	Cross-linked hidden-VM-for-evasion playbook

HuntPack v0.3 · QEMU Hidden-VM Evasion (STAC4713 / STAC3725) · Generated 2026-06-12 · Defensive use only — no offensive code. This is a defense-evasion technique: the host EDR cannot see inside the guest, so anchor on the host-visible hypervisor artifacts (Q1-Q5) and pivot to NDR/netflow (Q6/N4). Maintain a sanctioned-virtualization allow-list and validate field names before promoting any query.