Windows process creation rule for PowerShell/CMD spawned by prunsrv.exe (VMware Workspace ONE Access)

Alerts when prunsrv.exe spawns PowerShell or cmd.exe running PowerShell, consistent with potential Workspace ONE Access RCE attempts.

FreeUnreviewedSigmamediumv1

windows-process-creation-rule-for-powershell-cmd-spawned-by-prunsrv-exe-vmware-w-5660d8db

title: Windows process creation rule for PowerShell/CMD spawned by prunsrv.exe (VMware Workspace ONE Access)
id: 2db25056-26ca-41d7-95e1-ff796c507067
status: test
description: This rule flags potential exploitation activity where PowerShell or cmd.exe is launched as a child process of the legitimate Tomcat service executable prunsrv.exe. Attackers may use such execution to run attacker-controlled commands after abusing a remote code execution weakness. The detection relies on Windows process creation telemetry, matching parent and child process executable paths and, for cmd.exe, the presence of '/c powershell' in the command line.
references:
  - https://blog.morphisec.com/vmware-identity-manager-attack-backdoor
  - https://github.com/DrorDvash/CVE-2022-22954_VMware_PoC
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-22954/proc_creation_win_exploit_cve_2022_22954_vmware_workspace_one_rce.yml
author: "@kostastsale, Huntrule Team"
date: 2022-04-25
tags:
  - attack.execution
  - attack.initial-access
  - attack.t1059.006
  - attack.t1190
  - cve.2022-22954
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \prunsrv.exe
  selection_payload_pwsh:
    Image|endswith: \powershell.exe
  selection_payload_cmd:
    Image|endswith: \cmd.exe
    CommandLine|contains: /c powershell
  condition: selection_parent and 1 of selection_payload_*
falsepositives:
  - Some false positives are possible as part of a custom script implementation from admins executed with cmd.exe as the child process.
level: medium
license: DRL-1.1
related:
  - id: 5660d8db-6e25-411f-b92f-094420168a5d
    type: derived

What it detects

This rule flags potential exploitation activity where PowerShell or cmd.exe is launched as a child process of the legitimate Tomcat service executable prunsrv.exe. Attackers may use such execution to run attacker-controlled commands after abusing a remote code execution weakness. The detection relies on Windows process creation telemetry, matching parent and child process executable paths and, for cmd.exe, the presence of '/c powershell' in the command line.

Known false positives

Some false positives are possible as part of a custom script implementation from admins executed with cmd.exe as the child process.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.