Windows devcon.exe disables VMware VMCI device via VMCI driver identifiers

Flags devcon.exe command lines that disable VMware VMCI using VMCI PCI ID or VMWVMCIHOSTDEV driver markers.

FreeUnreviewedSigmahighv1

windows-devcon-exe-disables-vmware-vmci-device-via-vmci-driver-identifiers-85f520e7

title: Windows devcon.exe disables VMware VMCI device via VMCI driver identifiers
id: b967dabd-bb75-4aa5-9f05-3fd18e4877b1
status: experimental
description: This rule matches process executions of devcon.exe where the command line includes a device disable action and references VMware VMCI identifiers (VMCI PCI ID 15AD&DEV_0740 or VMWVMCIHOSTDEV). Attackers may use devcon to impair or alter device functionality to facilitate malicious behavior in virtualized environments. It relies on Windows process creation telemetry, including Image/OriginalFileName and CommandLine content.
references:
  - https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/devcon
  - https://communities.vmware.com/t5/VMware-Workstation-Pro/VMCI-driver-issues/td-p/2866060
  - https://github.com/search?q=devcon+disable+VMWVMCIHOSTDEV
  - https://huntress.com/blog/esxi-vm-escape-exploit
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_devcon_disable_vmci_driver.yml
author: Matt Anderson, Dray Agha, Anna Pham (Huntress), Huntrule Team
date: 2026-01-02
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.defense-impairment
  - attack.t1543.003
  - attack.t1685
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \devcon.exe
    - OriginalFileName: DevCon.exe
  selection_action:
    CommandLine|contains: " disable "
  selection_vmci_pci:
    CommandLine|contains:
      - 15AD&DEV_0740
      - VMWVMCIHOSTDEV
  condition: all of selection_*
falsepositives:
  - Legitimate VMware administration, Tools installation/uninstallation, or troubleshooting driver conflicts.
  - Automated scripts in virtualized environments for device cleanup.
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_devcon_disable_vmci_driver/info.yml
license: DRL-1.1
related:
  - id: 85f520e7-6f5e-43ca-874c-222e5bf9c0de
    type: derived

What it detects

This rule matches process executions of devcon.exe where the command line includes a device disable action and references VMware VMCI identifiers (VMCI PCI ID 15AD&DEV_0740 or VMWVMCIHOSTDEV). Attackers may use devcon to impair or alter device functionality to facilitate malicious behavior in virtualized environments. It relies on Windows process creation telemetry, including Image/OriginalFileName and CommandLine content.

Known false positives

Legitimate VMware administration, Tools installation/uninstallation, or troubleshooting driver conflicts.
Automated scripts in virtualized environments for device cleanup.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.