VMCI Device Disabled via Devcon
The rule detects the execution of the devcon.exe process with a command-line argument containing the word "disable". This is a strong indicator that an attempt is being made to disable one or more hardware devices on the system, which is highly suspicious outside of legitimate administrative or deployment activities.
Splunk (SPL)
