Potential Persistence Via VMwareToolBoxCmd.EXE VM State Change Script

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•15

This rule detects the execution of "VMwareToolBoxCmd.exe" with specific command-line arguments ("script" and "set") that indicate an attempt to configure a script to run when a virtual machine changes state. This technique can be used by adversaries to establish persistence within a virtualized environment.