Windows Virtual Smart Card Created Using TpmVscMgr.EXE

Flags execution of Tpmvscmgr.exe with a create command, indicating creation of a new virtual smart card.

FreeUnreviewedSigmamediumv1

windows-virtual-smart-card-created-using-tpmvscmgr-exe-c633622e

title: Windows Virtual Smart Card Created Using TpmVscMgr.EXE
id: fab30372-d1c9-4d03-855d-3a8cee46c3ec
status: test
description: This rule identifies process creation events where Tpmvscmgr.exe is executed with a command line containing the create operation, indicating a new virtual smart card is being provisioned. Attackers may use virtual smart card mechanisms to establish or manipulate authentication artifacts while remaining within standard Windows tooling. The detection relies on Windows process creation telemetry, matching the executable name and specific command-line content.
references:
  - https://learn.microsoft.com/en-us/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_tpmvscmgr_add_virtual_smartcard.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-15
tags:
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: \tpmvscmgr.exe
    OriginalFileName: TpmVscMgr.exe
  selection_cli:
    CommandLine|contains: create
  condition: all of selection_*
falsepositives:
  - Legitimate usage by an administrator
level: medium
license: DRL-1.1
related:
  - id: c633622e-cab9-4eaa-bb13-66a1d68b3e47
    type: derived

What it detects

This rule identifies process creation events where Tpmvscmgr.exe is executed with a command line containing the create operation, indicating a new virtual smart card is being provisioned. Attackers may use virtual smart card mechanisms to establish or manipulate authentication artifacts while remaining within standard Windows tooling. The detection relies on Windows process creation telemetry, matching the executable name and specific command-line content.

Known false positives

Legitimate usage by an administrator

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.