← Back to SOC feed Coverage →

Check Qemu DeviceMap

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-04-18T16:05:06Z · Confidence: medium

Hunt Hypothesis

The Check Qemu DeviceMap rule detects potential emulator or virtualization artifacts that may indicate the use of QEMU to run malicious code in a sandboxed environment. SOC teams should proactively hunt for this behavior to identify and mitigate threats that may be evading traditional detection methods by leveraging virtualization-based evasion techniques.

YARA Rule

rule Check_Qemu_DeviceMap
{
	meta:
		Author = "Nick Hoffman"
		Description = "Checks for Qemu reg keys"
		Sample = "de1af0e97e94859d372be7fcf3a5daa5"
	strings:
		$key = "HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0" nocase wide ascii
		$value = "Identifier" nocase wide ascii
		$data = "QEMU" wide nocase ascii
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 3 string patterns in its detection logic.

False Positive Guidance

Original source: https://github.com/Yara-Rules/rules/blob/main/antidebug_antivm/antidebug_antivm.yar