VM Escape VMware VMCI Device Disabling
This rule detects attempts to disable VMware VMCI (Virtual Machine Communication Interface) devices using 'devcon.exe'. This activity can be indicative of a VM escape attempt, as disabling VMCI might be a step to bypass security mechanisms or facilitate further exploitation within a virtualized environment. The rule specifically looks for 'devcon.exe' executing with 'disable' in the command line, targeting either 'PCI\VEN_15AD&DEV_0740' (VMCI device) or 'ROOT\VMWVMCIHOSTDEV' (VMCI host device).
Cortex XDR
