Potential CVE-2022-22954 Exploitation Attempt - VMware Workspace ONE Access Remote Code Execution
Detects potential exploitation attempts of CVE-2022-22954, a remote code execution vulnerability in VMware Workspace ONE Access and Identity Manager. The rule specifically looks for PowerShell or cmd.exe processes being spawned as child processes of the legitimate Tomcat "prunsrv.exe" process, which was observed as part of the attack chain by Morphisec.
Sigma
