T1062: Hypervisor
Summary
**This technique has been deprecated and should no longer be used.** A type-1 hypervisor is a software layer that sits between the guest operating systems and system's hardware. (Citation: Wikipedia Hypervisor) It presents a virtual running environment to an operating system. An example of a common hypervisor is Xen. (Citation: Wikipedia Xen) A type-1 hypervisor operates at a level below the operating system and could be designed with [Rootkit](https://attack.mitre.org/techniques/T1014) functionality to hide its existence from the guest operating system. (Citation: Myers 2007) A malicious hypervisor of this nature could be used to persist on systems through interruption.
Source Attribution
Source: MITRE ATT&CK · Confidence: high
Platforms
- Windows
Tactic
persistence
References
- https://attack.mitre.org/techniques/T1062
- https://capec.mitre.org/data/definitions/552.html
- https://en.wikipedia.org/wiki/Hypervisor
- http://en.wikipedia.org/wiki/Xen
- http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.90.8832&rep=rep1&type=pdf
- http://virtualization.info/en/news/2006/08/debunking-blue-pill-myth.html