I'm analyzing some malicious files on a VM and I'm noticing that every time I open a file, the host's antivirus detects it.
Why does this happen? Is the malicious content escaping to the host?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
What I'd guess is happening is: When the guest OS reads an infected file, the hypervisor reads part for of the virtual disk file, the host anti-virus intercepts this read, scans it for viruses, and detects the virus in the guest.
As a workaround I would configure your host AV to ignore the virtual disk files.