{"id":"85f520e7-6f5e-43ca-874c-222e5bf9c0de","title":"Devcon Execution Disabling VMware VMCI Device","description":"Detects execution of devcon.exe with commands that disable the VMware Virtual Machine Communication Interface (VMCI) device.\nThis can be legitimate during VMware Tools troubleshooting or driver conflicts, but may also indicate malware attempting to hijack communication with the hardware via the VMCI device.\nThis has been used to facilitate VMware ESXi vulnerability exploits to escape VMs and execute code on the ESXi host.\n","author":"Matt Anderson, Dray Agha, Anna Pham (Huntress)","status":"experimental","level":"high","date":"2026-01-02","modified":"","tags":["attack.persistence","attack.privilege-escalation","attack.defense-impairment","attack.t1543.003","attack.t1685"],"technique_ids":["T1543.003","T1685"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Legitimate VMware administration, Tools installation/uninstallation, or troubleshooting driver conflicts.","Automated scripts in virtualized environments for device cleanup."],"references":["https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/devcon","https://communities.vmware.com/t5/VMware-Workstation-Pro/VMCI-driver-issues/td-p/2866060","https://github.com/search?q=devcon+disable+VMWVMCIHOSTDEV","https://huntress.com/blog/esxi-vm-escape-exploit"],"source_path":"rules/windows/process_creation/proc_creation_win_devcon_disable_vmci_driver.yml","source_sha256":"4ff3a8af274fdd1b438d846d06a05c359f48c4c99bb159ec2b3acd5ae590b602","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_devcon_disable_vmci_driver.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Devcon Execution Disabling VMware VMCI Device\nid: 85f520e7-6f5e-43ca-874c-222e5bf9c0de\nstatus: experimental\ndescription: |\n    Detects execution of devcon.exe with commands that disable the VMware Virtual Machine Communication Interface (VMCI) device.\n    This can be legitimate during VMware Tools troubleshooting or driver conflicts, but may also indicate malware attempting to hijack communication with the hardware via the VMCI device.\n    This has been used to facilitate VMware ESXi vulnerability exploits to escape VMs and execute code on the ESXi host.\nreferences:\n    - https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/devcon\n    - https://communities.vmware.com/t5/VMware-Workstation-Pro/VMCI-driver-issues/td-p/2866060\n    - https://github.com/search?q=devcon+disable+VMWVMCIHOSTDEV\n    - https://huntress.com/blog/esxi-vm-escape-exploit\nauthor: Matt Anderson, Dray Agha, Anna Pham (Huntress)\ndate: 2026-01-02\ntags:\n    - attack.persistence\n    - attack.privilege-escalation\n    - attack.defense-impairment\n    - attack.t1543.003\n    - attack.t1685\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith: '\\devcon.exe'\n        - OriginalFileName: 'DevCon.exe'\n    selection_action:\n        CommandLine|contains: ' disable '\n    selection_vmci_pci:\n        CommandLine|contains:\n            - '15AD&DEV_0740' # VMware VMCI PCI device (Vendor 0x15AD = VMware, Device 0x0740 = VMCI)\n            - 'VMWVMCIHOSTDEV' # VMware VMCI root host device driver name\n    condition: all of selection_*\nfalsepositives:\n    - Legitimate VMware administration, Tools installation/uninstallation, or troubleshooting driver conflicts.\n    - Automated scripts in virtualized environments for device cleanup.\nlevel: high\nregression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_devcon_disable_vmci_driver/info.yml\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1543.003","id":"T1543.003","name":"Windows Service","page":"techniques/enterprise/T1543.003/"},{"key":"enterprise/T1685","id":"T1685","name":"Disable or Modify Tools","page":"techniques/enterprise/T1685/"}],"data_path":"data/detection-rules/85f520e7-6f5e-43ca-874c-222e5bf9c0de.json","kind":"sigma"}