Compliance Node Overview
MITRE ATT&CK T1564.006 (Run Virtual Instance) is an Enterprise Defense Evasion sub-technique of T1564 (Hide Artifacts). Adversaries may carry out malicious operations using a virtual instance to avoid detection. A wide variety of virtualization technologies exist that allow for the emulation of a computer or computing environment. By running malicious code inside of a virtual instance, adversaries can hide artifacts associated with their behavior from security tools that are unable to monitor activity inside the virtual instance. Affected platforms: Linux, macOS, Windows. MITRE-documented mitigations include M1042 Disable or Remove Feature or Program, M1038 Execution Prevention. The Center for Threat-Informed Defense maps this technique to NIST SP 800-53 Rev 5 controls CM-02, CM-06, CM-07, CM-08, SI-04, SI-07, SI-10.
Pillar: Cybersecurity · Authority: MITRE Corporation · Version: 1.0.0 · Last updated:
Primary source: https://attack.mitre.org/techniques/T1564/006/
SHA-256 integrity: 256a59bd9ff7d09e01ee15c3176a63850d9c66b7a3e8b0a1e94388af6d38063e
Primary Citations — 7 traced to source
- MITRE ATT&CK Technique T1564.006: Run Virtual Instance (https://attack.mitre.org/techniques/T1564/006/)
- MITRE ATT&CK Tactic TA0005: Defense Evasion (https://attack.mitre.org/tactics/TA0005/)
+ 5 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access