huntrule

Windows Process Creation: VMware Horizon Log4j RCE Attempt via ws_TomcatService to cmd/powershell

Alert on ws_TomcatService.exe spawning cmd.exe or PowerShell on Windows as suspicious exploitation activity.

FreeReviewedSigma · High · v5
Product
windows
Category
process_creation
Author
@kostastsale (SigmaHQ), DRL 1.1
Published
2022-01-14
Updated
2026-07-31
AnalysisDetection
title: "Windows Process Creation: VMware Horizon Log4j RCE Attempt via ws_TomcatService to cmd/powershell"
id: 23f360e5-b205-4655-a413-046c1bd1f080
status: test
description: This rule flags process creation events where the parent process is ws_TomcatService.exe and the child process is cmd.exe or powershell.exe. Such behavior can indicate an attacker triggering initial execution from a vulnerable VMware Horizon component, consistent with attempts to achieve remote code execution through Log4j exposure. It relies on Windows process creation telemetry capturing ParentImage and Image paths.
references:
  - https://portswigger.net/daily-swig/vmware-horizon-under-attack-as-china-based-ransomware-group-targets-log4j-vulnerability
  - https://twitter.com/TheDFIRReport/status/1482078434327244805
  - https://www.pwndefend.com/2022/01/07/log4shell-exploitation-and-hunting-on-vmware-horizon-cve-2021-44228/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-44228/proc_creation_win_exploit_cve_2021_44228_vmware_horizon_log4j.yml
author: "@kostastsale, Huntrule Team"
date: 2022-01-14
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2021-44228
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \ws_TomcatService.exe
  filter_main_shells:
    Image|endswith:
      - \cmd.exe
      - \powershell.exe
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 3eb91f0a-0060-424a-a676-59f5fdd75610
    type: derived