Skip to navigation

Threat reportThreat IntelligenceTL-2026-4880

Exploiting Reversing (ER) Series Article 05: Hyper-V Research (Part 01) by Alexandre Borges

MONITORING

Security research article by Alexandre Borges, part 01 of Hyper-V research in the Exploiting Reversing (ER) series, published 2025-03-12 as a 57-page PDF. It is educational vulnerability-research material; the source names no CVEs, exploitation in the wild, malware, IOCs or attribution. First disclosed .

Key facts

IdentifiersTL-2026-4880
Also known asER series article 05, Hyper-V (part 01)
SeverityINFO
First disclosed
Affected productsMicrosoft Hyper-V
ToolsBinDiff, Diaphora, IDA Pro, WinDbg
MITRE ATT&CK techniquesT1203 Exploitation for Client Execution, T1211 Exploitation for Stealth, T1588.006 Vulnerabilities, T1611 Escape to Host
MotivationUNKNOWN
Detection rules9 (1 shown free)
Sources6 cited sources

Detection coverage

As of 2026-10-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4880 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Hyper-V Worker Process (vmwp.exe) Spawning Child Process - Guest-to-Host Escape Indicator (SPL)

TL-2026-4880 (ER series article 05, Hyper-V part 01) describes the host-side attack surface of the Virtual Machine Worker Process (vmwp.exe). In normal operation vmwp.exe does not launch interactive shells or script/LOLBin interpreters. A shell, script host or LOLBin whose parent is vmwp.exe is a high-fidelity behavioural sign of code execution inside the worker process after a guest-to-host escape (T1611) or client-side exploitation (T1203). The source article is research only and names no in-the-wild exploitation; this rule is a thematic, behaviour-first hunt for the technique class.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1611, T1203, T1059.003, T1059.001
  • Data sources: sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational, windows_process_creation
  • Severity: high
  • Confidence: medium

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage="*vmwp.exe" NOT (Image="*conhost.exe" OR Image="*WerFault.exe") | eval shell_or_lolbin=if(match(Image,"(?i)(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|certutil|bitsadmin)[.]exe$"),"yes","no") | stats count min(_time) as first_seen max(_time) as last_seen values(Image) as child_images values(CommandLine) as command_lines values(shell_or_lolbin) as shell_or_lolbin by host User ParentImage | convert ctime(first_seen) ctime(last_seen) | table host User ParentImage child_images command_lines shell_or_lolbin count first_seen last_seen

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "vmwp.exe"
| where FileName !in~ ("conhost.exe", "WerFault.exe")
| extend ShellOrLolbin = FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, ShellOrLolbin, SHA256
| order by Timestamp desc

Sigma

title: Hyper-V Worker Process vmwp.exe Spawning Child Process
id: 7d1c4e0a-3b52-4f6e-9a18-5c2e8b7f0d41
status: experimental
description: Detects a child process launched by the Hyper-V Virtual Machine Worker Process (vmwp.exe). vmwp.exe does not normally spawn shells or script interpreters; a child process may indicate guest-to-host escape or exploitation of the worker process. Thematic detection derived from Hyper-V attack-surface research (TL-2026-4880).
references:
  - https://exploitreversing.com/2025/03/12/exploiting-reversing-er-series-article-05/
  - https://attack.mitre.org/techniques/T1611/
author: Threadlinqs Team
date: 2026/10/31
tags:
  - attack.privilege-escalation
  - attack.t1611
  - attack.execution
  - attack.t1203
  - attack.t1059.003
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\vmwp.exe'
  filter_benign:
    Image|endswith:
      - '\conhost.exe'
      - '\WerFault.exe'
  condition: selection and not filter_benign
falsepositives:
  - Third-party Hyper-V management or backup agents that launch helper processes from vmwp.exe
  - Microsoft debugging or crash-handling helpers other than conhost.exe and WerFault.exe
level: high

Known false positives:

  • Third-party Hyper-V management, backup or monitoring agents that spawn helper processes from vmwp.exe
  • Microsoft or vendor debugging and crash-handling helpers other than conhost.exe and WerFault.exe

Tuning notes: Scope to Hyper-V hosts via a host lookup. Baseline child processes of vmwp.exe for 7-14 days and add exclusions for approved backup or management agents. Alert on any shell or LOLBin child (shell_or_lolbin=yes) immediately; keep other children as hunt-level. Requires Sysmon EventCode 1 with ParentImage populated.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Hyper-V Worker Process (vmwp.exe) Spawning Child Process - Guest-to-Host Escape Indicator (KQL) · unlock with TL Creds
  • Repeated Hyper-V Worker/Management Process Crashes - Exploitation Attempt Indicator (KQL) · unlock with TL Creds
  • Hypervisor Research Tooling and Debug-Mode Configuration on Endpoints (KQL) · unlock with TL Creds
  • Hyper-V Worker Process (vmwp.exe) Spawning Child Process - Guest-to-Host Escape Indicator (Sigma) · unlock with TL Creds
  • Repeated Hyper-V Worker/Management Process Crashes - Exploitation Attempt Indicator (Sigma) · unlock with TL Creds
  • Hypervisor Research Tooling and Debug-Mode Configuration on Endpoints (Sigma) · unlock with TL Creds
  • Repeated Hyper-V Worker/Management Process Crashes - Exploitation Attempt Indicator (SPL) · unlock with TL Creds
  • Hypervisor Research Tooling and Debug-Mode Configuration on Endpoints (SPL) · unlock with TL Creds

Indicators of compromise

As of 2026-10-31, Threadlinqs Intelligence tracks 11 indicators of compromise for TL-2026-4880.

Sample indicators (1 of 11)

  • Domain: exploitreversing[.]com

Defanged, TLP:CLEAR. Full set of 11 indicators: unlock with TL Creds.

11 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

Article 05 of the Exploiting Reversing (ER) series, authored by Alexandre Borges and published on exploitreversing.com on 2025-03-12, is the first part of a Hyper-V focused effort. The series is described as a step-by-step examination of Windows, macOS, hypervisors and browsers from a security perspective. The article is delivered as a 57-page PDF and is tagged Architecture, Code review, Hyper-V, Hypervisor technology, IDA Pro, Windows internals, Reverse engineering and Vulnerability research. The author thanks Ilfak Guilfanov and Hex-Rays SA for their support of the series.

The PDF content examined references Hyper-V building blocks (VMBus, VSP/VSC, hypercalls, the Virtualization Infrastructure Driver (VID), the Virtual Machine Worker Process (vmwp), SLAT, Virtual Trust Levels and the Secure Kernel) and tooling such as IDA Pro, BinDiff, Diaphora, WinDbg, Visual Studio, the Windows SDK and WDK. Component and tool lists were derived from an automated summary of the PDF's text and hyperlinks, not from a full page-by-page read, and should be treated as indicative of scope rather than an exhaustive table of contents. It also links to earlier ER series articles 1-4 and the Malware Analysis Series.

No CVE identifiers, affected product versions, proof-of-concept exploit, CVSS data, indicators of compromise, malware family, threat actor or in-the-wild exploitation are stated in the source. This record is therefore tracked as low-priority THREAT_INTEL / research for defenders and detection engineers who want background on Hyper-V internals and the attack surface of the hypervisor. The MITRE ATT&CK mappings attached are thematic (the technique classes relevant to hypervisor vulnerability research) and are NOT evidence of observed adversary use.

MITRE ATT&CK techniques by tactic:

Execution

T1203 Exploitation for Client Execution

Defense Evasion

T1211 Exploitation for Stealth

Resource Development

T1588.006 Vulnerabilities

Privilege Escalation

T1611 Escape to Host

Remediation

Immediate actions

  • No vulnerability or exploitation is stated in the source; no immediate action required beyond awareness

Longer-term hardening

  • Keep Hyper-V hosts and Windows Server virtualization roles on current Microsoft security updates
  • Monitor vendor advisories for Hyper-V vulnerabilities that may follow from public hypervisor research

Affected and fixed versions

Timeline

  • Preceding series installment, ER series article 04 | macOS/iOS (part 01), was published on locked-ioc-4.
  • Article positioned as the fifth installment of the ER series covering Windows, macOS, hypervisors and browsers, following articles 1-4.
  • The 57-page PDF locked-ioc-3 was made available alongside the article.
  • Alexandre Borges published ER series article 05 | Hyper-V (part 01) on locked-ioc-4.
  • Following series installment, ER series article 06 | A Deep Dive Into Exploiting a Minifilter Driver (N-day), was published on locked-ioc-4.
  • Recorded as informational THREAT_INTEL research in MONITORING status; MITRE mappings are thematic only.
  • Article page and PDF re-fetched by the platform; confirmed no CVE, PoC, IOC, malware or attribution stated.

Sources cited

Previous and next in threat intel

Drafted by the Threadlinqs research pipeline from 6 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats