Virtualization

The subject uses a portable hypervisor to launch a virtual machine from removable media or user-space directories, enabling covert execution of tools, data staging, or operational activities. These hypervisors can run without installation, system-wide configuration changes, or elevated privileges, bypassing standard application control, endpoint detection, and logging.

Portable hypervisors are often used to:

• Run a fully isolated virtual environment on a corporate system without administrator rights.
• Avoid persistent installation footprints in the Windows registry, program files, or audit logs.
• Stage and execute sensitive operations inside a contained guest OS, shielded from host-level EDR tools.
• Exfiltrate or decrypt data using tools embedded in the VM image without writing them to disk.
• Destroy or remove evidence simply by ejecting the device or deleting the VM directory.

Example Scenarios:

• The subject carries a USB stick containing QEMU or VMware Workstation Player Portable, along with a pre-configured Linux VM that includes recon and exfiltration tools. They plug it into a shared workstation, launch the VM in user space, and remove the stick after completing the session.
• A portable VirtualBox distribution is run from an unmonitored folder in the user's home directory. Inside the VM, the subject transfers staged data, compresses it, and initiates covert upload via proxy-aware tools, leaving no trace on the host system.
• The subject uses an encrypted external SSD with VMware ThinApp to run virtualized applications (e.g., password extractors, tunneling tools) without installation or triggering AV signatures on the host.

The subject uses virtual machine snapshots, checkpoints, or revert-to-save-state features to erase forensic evidence of activity within a virtualized environment. By taking a snapshot before conducting malicious or high-risk operations, the subject ensures they can later roll the system back—removing all traces of files, commands, logs, and process history created during the session.

This technique allows the subject to:

• Create disposable execution environments for malware, exfiltration staging, or credential harvesting.
• Test or refine malicious payloads without contaminating the final operating state.
• Erase system logs, shell history, temp files, or volatile indicators without needing individual cleanup.
• Avoid triggering file integrity monitoring or host-based change detection on the base image.
• Delay detection by performing actions in a timeline that no longer exists once the rollback is complete.

Example Scenarios:

• A subject launches a virtual machine, takes a snapshot, and performs a simulated ransomware attack using internal files. After testing, they roll back to the original snapshot, deleting all evidence of tool execution, encryption activity, and lateral movement.
• During a data staging operation, the subject collects documents within a VM and compresses them. After extraction, they revert the VM to a pre-staging snapshot, eliminating any trace of the aggregation.
• An insider uses nested virtualization to test payload delivery across OS versions. Each test is followed by a rollback, leaving no visible trace of the toolsets used or the compromised states created.

The subject uses a virtual machine (VM) on an organization device to contain artifacts of forensic value within the virtualized environment, preventing them from being written to the host file system. This strategy helps to obscure evidence and complicate forensic investigations.
 

By running a guest operating system within a VM, the subject can potentially evade detection by security agents installed on the host operating system, as these agents may not have visibility into activities occurring within the VM. This adds an additional layer of complexity to forensic analysis, making it more challenging to detect and attribute malicious activities.

The subject leverages Windows Subsystem for Linux (WSL) to contain forensic artifacts within a Linux-like runtime environment embedded in Windows. By operating inside WSL, the subject avoids writing sensitive data, tool activity, or command history to traditional Windows locations, significantly reducing visibility to host-based forensic and security tools.

WSL creates a logical Linux environment that appears separate from the Windows file system. Although some host-guest integration exists, activity within WSL often bypasses standard Windows event logging, registry updates, and process tracking. This allows the subject to execute scripts, use Unix-native tools, stage exfiltration, or decrypt payloads with minimal footprint on the host.

Example Scenarios:

• The subject downloads and processes sensitive files inside the WSL environment using native Linux tools (e.g., scp, gpg, rsync), preventing access and modification timestamps from appearing in Windows Explorer or standard audit logs.
• A subject extracts and stages exfiltration material in /mnt/c within WSL, using symbolic links and Linux file permissions to obscure its presence from Windows search and indexing services.
• WSL is used to execute recon and credential-harvesting scripts (e.g., nmap, hydra, ssh enumeration tools), with no execution trace in Windows Event Logs.
• Upon completion of activity, the subject deletes the WSL distribution, leaving minimal residue on the host system—especially if no antivirus or EDR coverage extends into the WSL layer.