Windows Process Creation: VMware Horizon Tomcat Service Spawning cmd.exe or PowerShell

title: "Windows Process Creation: VMware Horizon Tomcat Service Spawning cmd.exe or PowerShell"
id: 23f360e5-b205-4655-a413-046c1bd1f080
status: test
description: This rule flags process creation where a Tomcat service executable associated with VMware Horizon (ws_TomcatService.exe) launches a command shell (cmd.exe) or PowerShell (powershell.exe). Such parent-to-child execution can indicate an attempt to run initial exploitation or follow-on commands from the service context. Detection relies on Windows process creation telemetry that includes parent image path and child image path.
references:
  - https://portswigger.net/daily-swig/vmware-horizon-under-attack-as-china-based-ransomware-group-targets-log4j-vulnerability
  - https://twitter.com/TheDFIRReport/status/1482078434327244805
  - https://www.pwndefend.com/2022/01/07/log4shell-exploitation-and-hunting-on-vmware-horizon-cve-2021-44228/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-44228/proc_creation_win_exploit_cve_2021_44228_vmware_horizon_log4j.yml
author: "@kostastsale, Huntrule Team"
date: 2022-01-14
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2021-44228
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \ws_TomcatService.exe
  filter_main_shells:
    Image|endswith:
      - \cmd.exe
      - \powershell.exe
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 3eb91f0a-0060-424a-a676-59f5fdd75610
    type: derived