TinyRCT VMware Masquerade: vmtools /usermode_hidetray and MicrosoftEdgeUpdate Schtask

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•1

Detects evidence of the TinyRCT backdoor, which masquerades as legitimate VMware utilities and system binaries. The rule monitors for malicious activity including suspicious execution of vmtools.exe/vmwared.exe from ProgramData, unauthorized scheduled task creation, PerfWatson2.exe execution outside of legitimate Visual Studio installation paths, and chrome_setup.exe execution from non-standard directories.