Potential CVE-2021-44228 Exploitation Attempt via VMware Horizon Tomcat
Detects potential initial exploitation attempts against VMware Horizon deployments running a vulnerable version of Log4j (CVE-2021-44228). Specifically, this rule looks for process creation events where the parent process is 'ws_TomcatService.exe' and the created process is NOT 'cmd.exe' or 'powershell.exe'. This aims to catch unexpected executables launched by the vulnerable Tomcat service as a result of successful Log4j exploitation.
Sigma
