VMToolsd Suspicious Child Process

Title: VMToolsd Suspicious Child Process
Status: test
Description:Detects suspicious child process creations of VMware Tools process which may indicate persistence setup
References:
  -https://bohops.com/2021/10/08/analyzing-and-detecting-a-vmtools-persistence-technique/
  -https://user-images.githubusercontent.com/61026070/136518004-b68cce7d-f9b8-4e9a-9b7b-53b1568a9a94.png
  -https://github.com/vmware/open-vm-tools/blob/master/open-vm-tools/tools.conf
Author: bohops, Bhabesh Raj
Date: 2021-10-08
modified:2023-07-25
Tags:

• -'attack.execution'
• -'attack.persistence'
• -'attack.t1059'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_parent:
    ParentImage|endswith: '\vmtoolsd.exe'
  selection_img:
    - Image|endswith:
      - '\cmd.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\regsvr32.exe'
      - '\rundll32.exe'
      - '\wscript.exe'
    - OriginalFileName:
      - 'Cmd.Exe'
      - 'cscript.exe'
      - 'MSHTA.EXE'
      - 'PowerShell.EXE'
      - 'pwsh.dll'
      - 'REGSVR32.EXE'
      - 'RUNDLL32.EXE'
      - 'wscript.exe'
  filter_main_vmwaretools_script:
    Image|endswith: '\cmd.exe'
    CommandLine|contains:
      -'\VMware\VMware Tools\poweron-vm-default.bat'
      -'\VMware\VMware Tools\poweroff-vm-default.bat'
      -'\VMware\VMware Tools\resume-vm-default.bat'
      -'\VMware\VMware Tools\suspend-vm-default.bat'

  filter_main_empty:
    Image|endswith: '\cmd.exe'
    CommandLine: ''
  filter_main_null:
    Image|endswith: '\cmd.exe'
    CommandLine: 'None'
  condition:all of selection* and not 1 of filter_main_*
Falsepositives:
  -Legitimate use by VM administrator
Level: high