Windows: VMwareToolBoxCmd.exe script/set Used to Configure VM State Persistence
Flags VMwareToolBoxCmd.exe use of 'script' and 'set' parameters consistent with VM state–based persistence.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-06-14
- Updated
- 2026-07-30
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies execution of VMwareToolBoxCmd.exe when the command line includes the 'script' and 'set' flags, indicating the tool is being used to configure a script tied to a specific VM state. Attackers can abuse VM tooling to persist across VM lifecycle events or trigger actions automatically under defined state changes. It relies on Windows process creation telemetry, matching process image name and required command-line substrings.
Reporting behind it
- bohops.comhttps://bohops.com/2021/10/08/analyzing-and-detecting-a-vmtools-persistence-technique/
- hexacorn.comhttps://www.hexacorn.com/blog/2017/01/14/beyond-good-ol-run-key-part-53/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_vmware_toolbox_cmd_persistence.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: VMwareToolBoxCmd.exe script/set Used to Configure VM State Persistence"
id: d7046b3b-0120-4f73-8bf7-f0312c071cf2
related:
- id: 236d8e89-ed95-4789-a982-36f4643738ba
type: derived
- id: 7aa4e81a-a65c-4e10-9f81-b200eb229d7d
type: derived
status: test
description: This rule identifies execution of VMwareToolBoxCmd.exe when the command line includes the 'script' and 'set' flags, indicating the tool is being used to configure a script tied to a specific VM state. Attackers can abuse VM tooling to persist across VM lifecycle events or trigger actions automatically under defined state changes. It relies on Windows process creation telemetry, matching process image name and required command-line substrings.
references:
- https://bohops.com/2021/10/08/analyzing-and-detecting-a-vmtools-persistence-technique/
- https://www.hexacorn.com/blog/2017/01/14/beyond-good-ol-run-key-part-53/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_vmware_toolbox_cmd_persistence.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-14
tags:
- attack.execution
- attack.persistence
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \VMwareToolBoxCmd.exe
- OriginalFileName: toolbox-cmd.exe
selection_cli:
CommandLine|contains|all:
- " script "
- " set "
condition: all of selection_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1