CL-STA-1062 Malware Masquerading as VMware Tools in ProgramData\VMware
Detects the execution of specific binaries (vmtools.exe, vmwared.exe, XDRAgent.exe) from the C:\ProgramData\VMware directory. This path is often used by adversaries to masquerade malicious files or execute tools from a directory that might be excluded from security scanning.
CQL
