Windows VMwareToolBoxCmd.exe Script/Set Execution Used for VM State Persistence

Alerts on VMwareToolBoxCmd.exe launched with script/set flags and command-line hints of a suspicious VM state persistence setup.

FreeUnreviewedSigmahighv1

windows-vmwaretoolboxcmd-exe-script-set-execution-used-for-vm-state-persistence-236d8e89

title: Windows VMwareToolBoxCmd.exe Script/Set Execution Used for VM State Persistence
id: 56555709-33b8-48f2-ab19-fe5d0152d7ec
related:
  - id: 7aa4e81a-a65c-4e10-9f81-b200eb229d7d
    type: derived
  - id: 236d8e89-ed95-4789-a982-36f4643738ba
    type: derived
status: test
description: This rule flags Windows process creation where VMwareToolBoxCmd.exe is launched with the script and set flags, indicating an attempt to configure a VM state change script. Such persistence matters because it can cause actions to run automatically in response to specific virtualization states. The detection relies on process creation telemetry, matching the executable image/original filename and requiring suspicious command-line flag usage and potentially risky script locations.
references:
  - https://bohops.com/2021/10/08/analyzing-and-detecting-a-vmtools-persistence-technique/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_vmware_toolbox_cmd_persistence_susp.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-14
tags:
  - attack.execution
  - attack.persistence
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_bin_img:
    - Image|endswith: \VMwareToolBoxCmd.exe
    - OriginalFileName: toolbox-cmd.exe
  selection_bin_cli:
    CommandLine|contains|all:
      - " script "
      - " set "
  selection_susp_paths:
    CommandLine|contains:
      - :\PerfLogs\
      - :\Temp\
      - :\Windows\System32\Tasks\
      - :\Windows\Tasks\
      - :\Windows\Temp\
      - \AppData\Local\Temp
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule flags Windows process creation where VMwareToolBoxCmd.exe is launched with the script and set flags, indicating an attempt to configure a VM state change script. Such persistence matters because it can cause actions to run automatically in response to specific virtualization states. The detection relies on process creation telemetry, matching the executable image/original filename and requiring suspicious command-line flag usage and potentially risky script locations.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.