Windows: VMware Xfer Utility DLL Sideloading via VMwareXferlogs.exe in Non-Default Path

Alert on VMwareXferlogs.exe launching from an unexpected directory, a potential DLL sideloading technique on Windows.

FreeUnreviewedSigmahighv1

windows-vmware-xfer-utility-dll-sideloading-via-vmwarexferlogs-exe-in-non-defaul-ebea773c

title: "Windows: VMware Xfer Utility DLL Sideloading via VMwareXferlogs.exe in Non-Default Path"
id: afd0fdb6-4c78-4b9e-a225-dcfa0039e893
status: test
description: This rule flags process creation where VMwareXferlogs.exe is executed from a directory other than the typical VMware installation location. Attackers may use VMware utilities to perform DLL sideloading and load malicious libraries through an otherwise legitimate executable path. The detection relies on Windows process creation telemetry capturing the full Image path for VMwareXferlogs.exe.
references:
  - https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_dll_sideload_vmware_xfer.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-02
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith: \VMwareXferlogs.exe
  filter:
    Image|startswith: C:\Program Files\VMware\
  condition: selection and not filter
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: ebea773c-a8f1-42ad-a856-00cb221966e8
    type: derived

What it detects

This rule flags process creation where VMwareXferlogs.exe is executed from a directory other than the typical VMware installation location. Attackers may use VMware utilities to perform DLL sideloading and load malicious libraries through an otherwise legitimate executable path. The detection relies on Windows process creation telemetry capturing the full Image path for VMwareXferlogs.exe.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.