Disabling VMware VMCI Device via Devcon
Detects the execution of devcon.exe with command-line arguments to disable the VMware Virtual Machine Communication Interface (VMCI) PCI device or host device driver. Threat actors use this technique to gain direct hardware access as a preparatory step for VM escape exploits.
Sigma
