CL-STA-1062 XDRAgent.exe Reverse Tunnel Proxy Execution

Ibrahim Saud@tektrix

•updated Jun 27, 2026•1•0•6

Detects the execution of process images known as 'XDRAgent.exe' or VMware administration tools ('vmtools.exe', 'vmwared.exe') when their command lines include patterns commonly associated with reverse shell communication, suspicious IP addresses, or unauthorized administrative arguments.