Consider a scenario where different services (such as DNS server) are hosted on virtual machines and protected by host based security tools in an organisation network. Emerging attacks perform malicious actions such as disabling the host based security tools in the monitored systems and installing rootkits with hidden processes in a vulnerable system. Then the attackers can use the compromised virtual machines to perform different attacks.

How does virtual machine introspection security tools can be used to detect zero-day attacks that can run rootkits with hidden processes in the virtual machines.