New Virtual Smart Card Created Via TpmVscMgr.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

This rule detects the execution of the 'TpmVscMgr.exe' utility with the 'create' command-line argument, indicating the creation of a new virtual smart card. This activity can be legitimate for system administration but could also be leveraged by adversaries for persistence or to bypass authentication mechanisms.