Suspicious Persistence Via VMwareToolBoxCmd.EXE VM State Change Script
Detects the use of "VMwareToolBoxCmd.exe" with the "script" and "set" flags to configure a script to run when a VM state changes. The rule specifically looks for scripts located in suspicious paths like temporary directories or Windows system directories, which could indicate an attempt at persistence or privilege escalation within a virtualized environment.
Sigma
