# Exploiting Reversing (ER) Series Article 05: Hyper-V Research (Part 01) by Alexandre Borges

> Security research article by Alexandre Borges, part 01 of Hyper-V research in the Exploiting Reversing (ER) series, published 2025-03-12 as a 57-page PDF. It is educational vulnerability-research material; the source names no CVEs, exploitation in the wild, malware, IOCs or attribution.

- **Published:** 2026-10-31T04:39:28Z
- **Last reviewed:** 2026-10-31T04:39:28Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4880
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-4880.png
- **ID:** TL-2026-4880
- **Severity:** INFO
- **Category:** THREAT_INTEL
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 11 (1 shown free below)

## Description

Article 05 of the Exploiting Reversing (ER) series, authored by Alexandre Borges and published on exploitreversing.com on 2025-03-12, is the first part of a Hyper-V focused effort. The series is described as a step-by-step examination of Windows, macOS, hypervisors and browsers from a security perspective. The article is delivered as a 57-page PDF and is tagged Architecture, Code review, Hyper-V, Hypervisor technology, IDA Pro, Windows internals, Reverse engineering and Vulnerability research. The author thanks Ilfak Guilfanov and Hex-Rays SA for their support of the series.

The PDF content examined references Hyper-V building blocks (VMBus, VSP/VSC, hypercalls, the Virtualization Infrastructure Driver (VID), the Virtual Machine Worker Process (vmwp), SLAT, Virtual Trust Levels and the Secure Kernel) and tooling such as IDA Pro, BinDiff, Diaphora, WinDbg, Visual Studio, the Windows SDK and WDK. Component and tool lists were derived from an automated summary of the PDF's text and hyperlinks, not from a full page-by-page read, and should be treated as indicative of scope rather than an exhaustive table of contents. It also links to earlier ER series articles 1-4 and the Malware Analysis Series.

No CVE identifiers, affected product versions, proof-of-concept exploit, CVSS data, indicators of compromise, malware family, threat actor or in-the-wild exploitation are stated in the source. This record is therefore tracked as low-priority THREAT_INTEL / research for defenders and detection engineers who want background on Hyper-V internals and the attack surface of the hypervisor. The MITRE ATT&CK mappings attached are thematic (the technique classes relevant to hypervisor vulnerability research) and are NOT evidence of observed adversary use.

## MITRE ATT&CK

- T1588.006 Vulnerabilities
- T1611 Escape to Host
- T1203 Exploitation for Client Execution
- T1211 Exploitation for Stealth

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Hyper-V Worker Process (vmwp.exe) Spawning Child Process - Guest-to-Host Escape Indicator (SPL)** (`TL-2026-4880-SPL-001`)

TL-2026-4880 (ER series article 05, Hyper-V part 01) describes the host-side attack surface of the Virtual Machine Worker Process (vmwp.exe). In normal operation vmwp.exe does not launch interactive shells or script/LOLBin interpreters. A shell, script host or LOLBin whose parent is vmwp.exe is a high-fidelity behavioural sign of code execution inside the worker process after a guest-to-host escape (T1611) or client-side exploitation (T1203). The source article is research only and names no in-the-wild exploitation; this rule is a thematic, behaviour-first hunt for the technique class.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1611, T1203, T1059.003, T1059.001
- **Data sources:** sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational, windows_process_creation
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage="*vmwp.exe" NOT (Image="*conhost.exe" OR Image="*WerFault.exe") | eval shell_or_lolbin=if(match(Image,"(?i)(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|certutil|bitsadmin)[.]exe$"),"yes","no") | stats count min(_time) as first_seen max(_time) as last_seen values(Image) as child_images values(CommandLine) as command_lines values(shell_or_lolbin) as shell_or_lolbin by host User ParentImage | convert ctime(first_seen) ctime(last_seen) | table host User ParentImage child_images command_lines shell_or_lolbin count first_seen last_seen
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "vmwp.exe"
| where FileName !in~ ("conhost.exe", "WerFault.exe")
| extend ShellOrLolbin = FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, ShellOrLolbin, SHA256
| order by Timestamp desc
```

### Sigma

```yaml
title: Hyper-V Worker Process vmwp.exe Spawning Child Process
id: 7d1c4e0a-3b52-4f6e-9a18-5c2e8b7f0d41
status: experimental
description: Detects a child process launched by the Hyper-V Virtual Machine Worker Process (vmwp.exe). vmwp.exe does not normally spawn shells or script interpreters; a child process may indicate guest-to-host escape or exploitation of the worker process. Thematic detection derived from Hyper-V attack-surface research (TL-2026-4880).
references:
  - https://exploitreversing.com/2025/03/12/exploiting-reversing-er-series-article-05/
  - https://attack.mitre.org/techniques/T1611/
author: Threadlinqs Team
date: 2026/10/31
tags:
  - attack.privilege-escalation
  - attack.t1611
  - attack.execution
  - attack.t1203
  - attack.t1059.003
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\vmwp.exe'
  filter_benign:
    Image|endswith:
      - '\conhost.exe'
      - '\WerFault.exe'
  condition: selection and not filter_benign
falsepositives:
  - Third-party Hyper-V management or backup agents that launch helper processes from vmwp.exe
  - Microsoft debugging or crash-handling helpers other than conhost.exe and WerFault.exe
level: high
```

**Known false positives:**

- Third-party Hyper-V management, backup or monitoring agents that spawn helper processes from vmwp.exe
- Microsoft or vendor debugging and crash-handling helpers other than conhost.exe and WerFault.exe

**Tuning notes:** Scope to Hyper-V hosts via a host lookup. Baseline child processes of vmwp.exe for 7-14 days and add exclusions for approved backup or management agents. Alert on any shell or LOLBin child (shell_or_lolbin=yes) immediately; keep other children as hunt-level. Requires Sysmon EventCode 1 with ParentImage populated.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Hyper-V Worker Process (vmwp.exe) Spawning Child Process - Guest-to-Host Escape Indicator (KQL) (locked: unlock with TL Creds)
- Repeated Hyper-V Worker/Management Process Crashes - Exploitation Attempt Indicator (KQL) (locked: unlock with TL Creds)
- Hypervisor Research Tooling and Debug-Mode Configuration on Endpoints (KQL) (locked: unlock with TL Creds)
- Hyper-V Worker Process (vmwp.exe) Spawning Child Process - Guest-to-Host Escape Indicator (Sigma) (locked: unlock with TL Creds)
- Repeated Hyper-V Worker/Management Process Crashes - Exploitation Attempt Indicator (Sigma) (locked: unlock with TL Creds)
- Hypervisor Research Tooling and Debug-Mode Configuration on Endpoints (Sigma) (locked: unlock with TL Creds)
- Repeated Hyper-V Worker/Management Process Crashes - Exploitation Attempt Indicator (SPL) (locked: unlock with TL Creds)
- Hypervisor Research Tooling and Debug-Mode Configuration on Endpoints (SPL) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 11)

Defanged, TLP:CLEAR.

- Domain: `exploitreversing[.]com`

Full set of 11 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Exploiting Reversing (ER) series: article 05 | Hyper-V (part 01)](https://exploitreversing.com/2025/03/12/exploiting-reversing-er-series-article-05/)
- [ER series article 05 PDF (57 pages)](https://exploitreversing.com/wp-content/uploads/2025/03/exploit_reversing_05.pdf)
- [Exploiting Reversing Series (ERS) and Memory Attack Series (MAS) by Alexandre Borges](https://undercodetesting.com/exploiting-reversing-series-ers-and-memory-attack-series-mas-by-alexandre-borges/)
- [Unlock the Secrets of Exploit Development: 945 Pages of Real-World Reverse Engineering Mastery](https://undercodetesting.com/unlock-the-secrets-of-exploit-development-945-pages-of-real-world-reverse-engineering-mastery-video/)
- [r/ExploitDev research papers archive](https://redlib.hackliberty.org/r/ExploitDev/comments/1l6eezt/research_papers_archive)
- [awesome-hyper-v-exploitation (shogunlab)](https://www.context-awesome.com/list/shogunlab/awesome-hyper-v-exploitation)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4880