Potential Persistence Via VMwareToolBoxCmd.EXE VM State Change Script

Title: Potential Persistence Via VMwareToolBoxCmd.EXE VM State Change Script
Status: test
Description:Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script to run for a specific VM state
References:
  -https://bohops.com/2021/10/08/analyzing-and-detecting-a-vmtools-persistence-technique/
  -https://www.hexacorn.com/blog/2017/01/14/beyond-good-ol-run-key-part-53/
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-06-14
modified:None
Tags:

• -'attack.execution'
• -'attack.persistence'
• -'attack.t1059'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\VMwareToolBoxCmd.exe' OriginalFileName:'toolbox-cmd.exe'   selection_cli:
    CommandLine|contains|all:
      -' script '
      -' set '

  condition:all of selection_*
Falsepositives:
  -Unknown
Level: medium