Windows.Detection.HyperV

https://docs.velociraptor.app/exchange/artifacts/pages/hyperv/

Scope suspicious Hyper-V worker processes and activity on Windows workstations.