Windows VMwareToolBoxCmd.exe Script/Set Execution Used for VM State Persistence
Alerts on VMwareToolBoxCmd.exe launched with script/set flags and command-line hints of a suspicious VM state persistence setup.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-06-14
- Updated
- 2026-07-30
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation where VMwareToolBoxCmd.exe is launched with the script and set flags, indicating an attempt to configure a VM state change script. Such persistence matters because it can cause actions to run automatically in response to specific virtualization states. The detection relies on process creation telemetry, matching the executable image/original filename and requiring suspicious command-line flag usage and potentially risky script locations.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows VMwareToolBoxCmd.exe Script/Set Execution Used for VM State Persistence
id: 56555709-33b8-48f2-ab19-fe5d0152d7ec
related:
- id: 7aa4e81a-a65c-4e10-9f81-b200eb229d7d
type: derived
- id: 236d8e89-ed95-4789-a982-36f4643738ba
type: derived
status: test
description: This rule flags Windows process creation where VMwareToolBoxCmd.exe is launched with the script and set flags, indicating an attempt to configure a VM state change script. Such persistence matters because it can cause actions to run automatically in response to specific virtualization states. The detection relies on process creation telemetry, matching the executable image/original filename and requiring suspicious command-line flag usage and potentially risky script locations.
references:
- https://bohops.com/2021/10/08/analyzing-and-detecting-a-vmtools-persistence-technique/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_vmware_toolbox_cmd_persistence_susp.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-14
tags:
- attack.execution
- attack.persistence
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_bin_img:
- Image|endswith: \VMwareToolBoxCmd.exe
- OriginalFileName: toolbox-cmd.exe
selection_bin_cli:
CommandLine|contains|all:
- " script "
- " set "
selection_susp_paths:
CommandLine|contains:
- :\PerfLogs\
- :\Temp\
- :\Windows\System32\Tasks\
- :\Windows\Tasks\
- :\Windows\Temp\
- \AppData\Local\Temp
condition: all of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1