I've use this method recently. Our VM service is based on libvirt, which doesn't support QEMU socket type interface natively, so I need to add the following to the XML:<p><pre><code> <qemu:commandline>
<qemu:arg value='-netdev'/>
<qemu:arg value='socket,id=mynet0,listen=10.6.0.1:12200'/>
<qemu:arg value='-device'/>
<qemu:arg value='virtio-net-pci,netdev=mynet0,id=net1,mac=58:a4:c0:a8:bf:51,bus=pci.0,addr=0x3'/>
</qemu:commandline>
</code></pre>
On the other endpoint, a Linux TAP tunnel daemon is responsible for encapsulating packet to the Length-Value data as the article said.<p>In this way, I can create a L2 tunnel from remote site to the VM, also keep the VM untainted.
Slightly related, I remember reading once of malware that uses a virtual machine running TinyXP[0] to obfuscate itself from the host OS. The footprint of TinyXP is tiny compared to the latest versions of Windows and runs on very little RAM, and gets past reverse engineering ploys which aim to unravel what the malware does.<p>[0] <a href="https://archive.org/details/tiny-xp-rev-11" rel="nofollow">https://archive.org/details/tiny-xp-rev-11</a>
This case exemplifies the importance of a layered security approach, integrating endpoint protection and network monitoring, to effectively combat such stealthy techniques.