Query: Sigma rule for Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script that's locat
Matching passage: Sigma rule: Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script that's locat. Logsource: windows / process_creation. Rule: title: Suspicious Persistence Via VMwareToolBoxCmd.EXE VM State Change Script id: 236d8e89-ed95-4789-a982-36f4643738ba related: - id: 7aa4e81a-a65c-4e10-9f81-b200eb229d7d type: derived status: test description: Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script that's located in a potentially suspicious location to run for a specific VM state references: - https://bohops.com/2021/10/08/analyzing-and-detecting-a-vmtools-persistence-technique/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-14 tags: - attack.execution - attack.persistence - attack.t1059 logsource: category: process_creation product: windows detection: selection_bin_img: - Image|endswith: \VMwareToolBoxCmd.exe - OriginalFileName: toolbox-cmd.exe selection_bin_cli: CommandLine|contains|all: - ' script ' - ' set ' selection_susp_paths: CommandLine|contains: - :\PerfLogs\ - :\Temp\ - :\Windows\System32\Tasks\ - :\Windows\Tasks\ - :\Windows\Temp\ - \AppData\Local\Temp condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects uncommon target processes for remote thread creation. Logsource: windows / create_remote_thread. Rule: title: Remote Thread Creation In Uncommon Target Image id: a1a144b7-5c9b-4853-a559-2172be8d4a03 related: - id: f016c716-754a-467f-a39e-63c06f773987 type: obsolete status: test description: Detects uncommon target processes for remote thread creation references: - https://web.archive.org/web/20220319032520/https://blog.redbluepurple.io/offensive-research/bypassing-injection-detection author: Florian Roth (Nextron Systems) date: 2022-03-16 modified: 2025-07-04 tags: - attack.privilege-escalation - attack.stealth - attack.t1055.003 logsource: product: windows category: create_remote_thread detection: selection: TargetImage|endswith: - \calc.exe - \calculator.exe - \mspaint.exe - \notepad.exe - \ping.exe - \sethc.exe - \spoolsv.exe - \wordpad.exe - \write.exe filter_main_csrss: SourceImage: C:\Windows\System32\csrss.exe filter_main_notepad: SourceImage: - C:\Windows\System32\explorer.exe - C:\Windows\System32\OpenWith.exe TargetImage: C:\Windows\System32\notepad.exe filter_main_sethc: SourceImage: C:\Windows\System32\AtBroker.exe TargetImage: C:\Windows\System32\Sethc.exe filter_optional_aurora_1: StartFunction: EtwpNotificationThread filter_optional_aurora_2: SourceImage|contains: unknown process filter_optional_vmtoolsd: SourceImage: C:\Program Files\VMware\VMware Tools\vmtoolsd.exe StartFunction: GetCommandLineW TargetImage: - C:\Windows\System32\notepad.exe - C:\Windows\System32\spoolsv.exe filter_optional_xerox_pjems: SourceImage: C:\Program Files\Xerox\XeroxPrintExperience\CommonFiles\XeroxPrintJobEventManagerService.exe StartFunction: LoadLibraryW TargetImage: C:\Windows\System32\spoolsv.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium