Windows Process Creation: Suspicious PowerShell Child of Tomcat prunsrv.exe (CVE-2022-22954 Attempt)
Alerts when prunsrv.exe spawns PowerShell or cmd.exe running PowerShell, consistent with potential Workspace ONE Access RCE attempts.
- Product
- windows
- Category
- process_creation
- Author
- @kostastsale (SigmaHQ), DRL 1.1
- Published
- 2022-04-25
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → ExecutionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule looks for Windows process creation events where cmd.exe or powershell.exe is spawned as a child of the Tomcat service executable prunsrv.exe. It is intended to flag behaviors consistent with attempted remote code execution exploitation related to CVE-2022-22954 in VMware Workspace ONE Access/Identity Manager environments. The detection relies on telemetry that provides the parent process image path and the child process image and command line.
Reporting behind it
- blog.morphisec.comhttps://blog.morphisec.com/vmware-identity-manager-attack-backdoor
- github.comhttps://github.com/DrorDvash/CVE-2022-22954_VMware_PoC
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-22954/proc_creation_win_exploit_cve_2022_22954_vmware_workspace_one_rce.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: Suspicious PowerShell Child of Tomcat prunsrv.exe (CVE-2022-22954 Attempt)"
id: 2db25056-26ca-41d7-95e1-ff796c507067
status: test
description: This rule looks for Windows process creation events where cmd.exe or powershell.exe is spawned as a child of the Tomcat service executable prunsrv.exe. It is intended to flag behaviors consistent with attempted remote code execution exploitation related to CVE-2022-22954 in VMware Workspace ONE Access/Identity Manager environments. The detection relies on telemetry that provides the parent process image path and the child process image and command line.
references:
- https://blog.morphisec.com/vmware-identity-manager-attack-backdoor
- https://github.com/DrorDvash/CVE-2022-22954_VMware_PoC
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-22954/proc_creation_win_exploit_cve_2022_22954_vmware_workspace_one_rce.yml
author: "@kostastsale, Huntrule Team"
date: 2022-04-25
tags:
- attack.execution
- attack.initial-access
- attack.t1059.006
- attack.t1190
- cve.2022-22954
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith: \prunsrv.exe
selection_payload_pwsh:
Image|endswith: \powershell.exe
selection_payload_cmd:
Image|endswith: \cmd.exe
CommandLine|contains: /c powershell
condition: selection_parent and 1 of selection_payload_*
falsepositives:
- Some false positives are possible as part of a custom script implementation from admins executed with cmd.exe as the child process.
level: medium
license: DRL-1.1
related:
- id: 5660d8db-6e25-411f-b92f-094420168a5d
type: derived