Windows Virtual Smart Card Created Using TpmVscMgr.EXE
Flags execution of Tpmvscmgr.exe with a create command, indicating creation of a new virtual smart card.
FreeReviewedSigma · Medium · v1
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-06-15
- Updated
- 2026-07-30
What it detects
This rule identifies process creation events where Tpmvscmgr.exe is executed with a command line containing the create operation, indicating a new virtual smart card is being provisioned. Attackers may use virtual smart card mechanisms to establish or manipulate authentication artifacts while remaining within standard Windows tooling. The detection relies on Windows process creation telemetry, matching the executable name and specific command-line content.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-virtual-smart-card-created-using-tpmvscmgr-exe-c633622e
title: Windows Virtual Smart Card Created Using TpmVscMgr.EXE
id: fab30372-d1c9-4d03-855d-3a8cee46c3ec
status: test
description: This rule identifies process creation events where Tpmvscmgr.exe is executed with a command line containing the create operation, indicating a new virtual smart card is being provisioned. Attackers may use virtual smart card mechanisms to establish or manipulate authentication artifacts while remaining within standard Windows tooling. The detection relies on Windows process creation telemetry, matching the executable name and specific command-line content.
references:
- https://learn.microsoft.com/en-us/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_tpmvscmgr_add_virtual_smartcard.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-15
tags:
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith: \tpmvscmgr.exe
OriginalFileName: TpmVscMgr.exe
selection_cli:
CommandLine|contains: create
condition: all of selection_*
falsepositives:
- Legitimate usage by an administrator
level: medium
license: DRL-1.1
related:
- id: c633622e-cab9-4eaa-bb13-66a1d68b3e47
type: derived