Windows Process Creation: Suspicious PowerShell Child of Tomcat prunsrv.exe (CVE-2022-22954 Attempt)

Alerts when prunsrv.exe spawns PowerShell or cmd.exe running PowerShell, consistent with potential Workspace ONE Access RCE attempts.

FreeReviewedSigma · Medium · v5
Product
windows
Category
process_creation
Author
@kostastsale (SigmaHQ), DRL 1.1
Published
2022-04-25
Updated
2026-07-31
title: "Windows Process Creation: Suspicious PowerShell Child of Tomcat prunsrv.exe (CVE-2022-22954 Attempt)"
id: 2db25056-26ca-41d7-95e1-ff796c507067
status: test
description: This rule looks for Windows process creation events where cmd.exe or powershell.exe is spawned as a child of the Tomcat service executable prunsrv.exe. It is intended to flag behaviors consistent with attempted remote code execution exploitation related to CVE-2022-22954 in VMware Workspace ONE Access/Identity Manager environments. The detection relies on telemetry that provides the parent process image path and the child process image and command line.
references:
  - https://blog.morphisec.com/vmware-identity-manager-attack-backdoor
  - https://github.com/DrorDvash/CVE-2022-22954_VMware_PoC
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-22954/proc_creation_win_exploit_cve_2022_22954_vmware_workspace_one_rce.yml
author: "@kostastsale, Huntrule Team"
date: 2022-04-25
tags:
  - attack.execution
  - attack.initial-access
  - attack.t1059.006
  - attack.t1190
  - cve.2022-22954
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \prunsrv.exe
  selection_payload_pwsh:
    Image|endswith: \powershell.exe
  selection_payload_cmd:
    Image|endswith: \cmd.exe
    CommandLine|contains: /c powershell
  condition: selection_parent and 1 of selection_payload_*
falsepositives:
  - Some false positives are possible as part of a custom script implementation from admins executed with cmd.exe as the child process.
level: medium
license: DRL-1.1
related:
  - id: 5660d8db-6e25-411f-b92f-094420168a5d
    type: derived