Possible Persistence Through VMwareToolBoxCmd.EXE VM State Change Script (via process_creation)

title: Possible Persistence Through VMwareToolBoxCmd.EXE VM State Change Script (via process_creation)
id: ba153926-3696-5358-aea5-3e1c545ba048
status: stable
description: This rule detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script to run for a specific VM state
references:
    - https://attack.mitre.org/techniques/T1059/
    - https://bohops.com/2021/10/08/analyzing-and-detecting-a-vmtools-persistence-technique/
    - https://www.hexacorn.com/blog/2017/01/14/beyond-good-ol-run-key-part-53/
author: Huntrule Team
date: 2026-01-02
tags:
    - attack.execution
    - attack.persistence
    - attack.t1059
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\VMwareToolBoxCmd.exe'
        - OriginalFileName: 'toolbox-cmd.exe'
    selection_cli:
        CommandLine|contains|all:
            - ' script '
            - ' set '
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium