Executing malware in VM

Hi,



Even if I run malware in a VM, there is still a chance that the malware will scan the local network and possibly infect it, right?



Even if I turn off network discovery, it doesn't stop the malware from just turning it on, or does it?



And then it's only a short way to scan the network and infect unsecured SMB shares or similar.



Or am I seeing this wrong? Is there a way to prevent this?

cybersecurity discovery infect local local network malware network network discovery run scan turn