{"id":"5687f942-867b-4578-ade7-1e341c46e99a","title":"VMToolsd Suspicious Child Process","description":"Detects suspicious child process creations of VMware Tools process which may indicate persistence setup","author":"bohops, Bhabesh Raj","status":"test","level":"high","date":"2021-10-08","modified":"2023-07-25","tags":["attack.execution","attack.persistence","attack.t1059"],"technique_ids":["T1059"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Legitimate use by VM administrator"],"references":["https://bohops.com/2021/10/08/analyzing-and-detecting-a-vmtools-persistence-technique/","https://user-images.githubusercontent.com/61026070/136518004-b68cce7d-f9b8-4e9a-9b7b-53b1568a9a94.png","https://github.com/vmware/open-vm-tools/blob/master/open-vm-tools/tools.conf"],"source_path":"rules/windows/process_creation/proc_creation_win_vmware_vmtoolsd_susp_child_process.yml","source_sha256":"7f9748d35baa0c893434017980e27813582f9e629723972e92bfd61fd5ab0061","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_vmware_vmtoolsd_susp_child_process.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: VMToolsd Suspicious Child Process\nid: 5687f942-867b-4578-ade7-1e341c46e99a\nstatus: test\ndescription: Detects suspicious child process creations of VMware Tools process which may indicate persistence setup\nreferences:\n    - https://bohops.com/2021/10/08/analyzing-and-detecting-a-vmtools-persistence-technique/\n    - https://user-images.githubusercontent.com/61026070/136518004-b68cce7d-f9b8-4e9a-9b7b-53b1568a9a94.png\n    - https://github.com/vmware/open-vm-tools/blob/master/open-vm-tools/tools.conf\nauthor: bohops, Bhabesh Raj\ndate: 2021-10-08\nmodified: 2023-07-25\ntags:\n    - attack.execution\n    - attack.persistence\n    - attack.t1059\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_parent:\n        ParentImage|endswith: '\\vmtoolsd.exe'\n    selection_img:\n        - Image|endswith:\n              - '\\cmd.exe'\n              - '\\cscript.exe'\n              - '\\mshta.exe'\n              - '\\powershell.exe'\n              - '\\pwsh.exe'\n              - '\\regsvr32.exe'\n              - '\\rundll32.exe'\n              - '\\wscript.exe'\n        - OriginalFileName:\n              - 'Cmd.Exe'\n              - 'cscript.exe'\n              - 'MSHTA.EXE'\n              - 'PowerShell.EXE'\n              - 'pwsh.dll'\n              - 'REGSVR32.EXE'\n              - 'RUNDLL32.EXE'\n              - 'wscript.exe'\n    filter_main_vmwaretools_script:\n        Image|endswith: '\\cmd.exe'\n        CommandLine|contains:\n            - '\\VMware\\VMware Tools\\poweron-vm-default.bat'\n            - '\\VMware\\VMware Tools\\poweroff-vm-default.bat'\n            - '\\VMware\\VMware Tools\\resume-vm-default.bat'\n            - '\\VMware\\VMware Tools\\suspend-vm-default.bat'\n    filter_main_empty:\n        Image|endswith: '\\cmd.exe'\n        CommandLine: ''\n    filter_main_null:\n        Image|endswith: '\\cmd.exe'\n        CommandLine: null\n    condition: all of selection* and not 1 of filter_main_*\nfalsepositives:\n    - Legitimate use by VM administrator\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059","id":"T1059","name":"Command and Scripting Interpreter","page":"techniques/enterprise/T1059/"}],"data_path":"data/detection-rules/5687f942-867b-4578-ade7-1e341c46e99a.json","kind":"sigma"}