Query: detect Detects execution of devcon.exe with commands that disable the VMware Virtual Machine Communication Interface (VMCI) dev in logs
Matching passage: Sigma rule: Detects execution of devcon.exe with commands that disable the VMware Virtual Machine Communication Interface (VMCI) dev. Logsource: windows / process_creation. Rule: title: Devcon Execution Disabling VMware VMCI Device id: 85f520e7-6f5e-43ca-874c-222e5bf9c0de status: experimental description: 'Detects execution of devcon.exe with commands that disable the VMware Virtual Machine Communication Interface (VMCI) device. This can be legitimate during VMware Tools troubleshooting or driver conflicts, but may also indicate malware attempting to hijack communication with the hardware via the VMCI device. This has been used to facilitate VMware ESXi vulnerability exploits to escape VMs and execute code on the ESXi host. ' references: - https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/devcon - https://communities.vmware.com/t5/VMware-Workstation-Pro/VMCI-driver-issues/td-p/2866060 - https://github.com/search?q=devcon+disable+VMWVMCIHOSTDEV - https://huntress.com/blog/esxi-vm-escape-exploit author: Matt Anderson, Dray Agha, Anna Pham (Huntress) date: 2026-01-02 tags: - attack.persistence - attack.privilege-escalation - attack.defense-impairment - attack.t1543.003 - attack.t1685 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \devcon.exe - OriginalFileName: DevCon.exe selection_action: CommandLine|contains: ' disable ' selection_vmci_pci: CommandLine|contains: - 15AD&DEV_0740 - VMWVMCIHOSTDEV condition: all of selection_* falsepositives: - Legitimate VMware administration, Tools installation/uninstallation, or troubleshooting driver conflicts. - Automated scripts in virtualized environments for device cleanup. level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_devcon_disable_vmci_driver/info.yml
Near-miss passage: Sigma rule: Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by setting t. Logsource: windows / registry_set. Rule: title: Windows Recall Feature Enabled - Registry id: 75180c5f-4ea1-461a-a4f6-6e4700c065d4 related: - id: 5dfc1465-8f65-4fde-8eb5-6194380c6a62 type: similar - id: 817f252c-5143-4dae-b418-48c3e9f63728 type: similar status: test description: 'Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by setting the value of "DisableAIDataAnalysis" to "0". Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities. This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary. ' references: - https://learn.microsoft.com/en-us/windows/client-management/manage-recall - https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-windowsai#disableaidataanalysis author: Sajid Nawaz Khan date: 2024-06-02 tags: - attack.collection - attack.t1113 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Software\Policies\Microsoft\Windows\WindowsAI\DisableAIDataAnalysis Details: DWORD (0x00000000) condition: selection falsepositives: - Legitimate use/activation of Windows Recall level: medium