Windows devcon.exe Command Line Disabling VMware VMCI Device
Flags devcon.exe command lines that disable VMware VMCI using VMCI PCI ID or VMWVMCIHOSTDEV driver markers.
- Product
- windows
- Category
- process_creation
- Author
- Matt Anderson, Dray Agha, Anna Pham (Huntress) (SigmaHQ), DRL 1.1
- Published
- 2026-01-02
- Updated
- 2026-07-31
ATT&CK techniques
Persistence → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
Detects process executions of devcon.exe where the command line includes disabling directives alongside VMware VMCI identifiers. This behavior matters because altering or disabling the VMCI device can be used to disrupt or hijack virtualization hardware communication paths. The rule relies on Windows process creation telemetry including the executable name and command-line content such as the VMCI device ID and driver name.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/devcon
- communities.vmware.comhttps://communities.vmware.com/t5/VMware-Workstation-Pro/VMCI-driver-issues/td-p/2866060
- github.comhttps://github.com/search?q=devcon+disable+VMWVMCIHOSTDEV
- huntress.comhttps://huntress.com/blog/esxi-vm-escape-exploit
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_devcon_disable_vmci_driver.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows devcon.exe Command Line Disabling VMware VMCI Device
id: b967dabd-bb75-4aa5-9f05-3fd18e4877b1
status: experimental
description: Detects process executions of devcon.exe where the command line includes disabling directives alongside VMware VMCI identifiers. This behavior matters because altering or disabling the VMCI device can be used to disrupt or hijack virtualization hardware communication paths. The rule relies on Windows process creation telemetry including the executable name and command-line content such as the VMCI device ID and driver name.
references:
- https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/devcon
- https://communities.vmware.com/t5/VMware-Workstation-Pro/VMCI-driver-issues/td-p/2866060
- https://github.com/search?q=devcon+disable+VMWVMCIHOSTDEV
- https://huntress.com/blog/esxi-vm-escape-exploit
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_devcon_disable_vmci_driver.yml
author: Matt Anderson, Dray Agha, Anna Pham (Huntress), Huntrule Team
date: 2026-01-02
tags:
- attack.persistence
- attack.privilege-escalation
- attack.defense-impairment
- attack.t1543.003
- attack.t1685
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \devcon.exe
- OriginalFileName: DevCon.exe
selection_action:
CommandLine|contains: " disable "
selection_vmci_pci:
CommandLine|contains:
- 15AD&DEV_0740
- VMWVMCIHOSTDEV
condition: all of selection_*
falsepositives:
- Legitimate VMware administration, Tools installation/uninstallation, or troubleshooting driver conflicts.
- Automated scripts in virtualized environments for device cleanup.
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_devcon_disable_vmci_driver/info.yml
license: DRL-1.1
related:
- id: 85f520e7-6f5e-43ca-874c-222e5bf9c0de
type: derived