Windows: VMwareToolBoxCmd.exe script/set Used to Configure VM State Persistence

title: "Windows: VMwareToolBoxCmd.exe script/set Used to Configure VM State Persistence"
id: d7046b3b-0120-4f73-8bf7-f0312c071cf2
related:
  - id: 236d8e89-ed95-4789-a982-36f4643738ba
    type: derived
  - id: 7aa4e81a-a65c-4e10-9f81-b200eb229d7d
    type: derived
status: test
description: This rule identifies execution of VMwareToolBoxCmd.exe when the command line includes the 'script' and 'set' flags, indicating the tool is being used to configure a script tied to a specific VM state. Attackers can abuse VM tooling to persist across VM lifecycle events or trigger actions automatically under defined state changes. It relies on Windows process creation telemetry, matching process image name and required command-line substrings.
references:
  - https://bohops.com/2021/10/08/analyzing-and-detecting-a-vmtools-persistence-technique/
  - https://www.hexacorn.com/blog/2017/01/14/beyond-good-ol-run-key-part-53/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_vmware_toolbox_cmd_persistence.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-14
tags:
  - attack.execution
  - attack.persistence
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \VMwareToolBoxCmd.exe
    - OriginalFileName: toolbox-cmd.exe
  selection_cli:
    CommandLine|contains|all:
      - " script "
      - " set "
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1