Virtualbox Driver Installation or Starting of VMs — Detection Rule
Adversaries can carry out malicious operations using a virtual instance to avoid detection. This rule is built to detect the registration of the Virtualbox driver or start of a Virtualbox VM.