DLL Sideloading by VMware Xfer Utility from Non-Default Path

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•14

Detects the execution of the VMware Xfer utility (VMwareXferlogs.exe) from a directory other than its default installation path. This behavior is indicative of an attempt to sideload arbitrary DLLs, often used by adversaries for privilege escalation, persistence, or defense evasion. The rule specifically looks for instances where 'VMwareXferlogs.exe' is executed from a location not starting with 'C:\Program Files\VMware\'.