Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1 detection
Filters
Last updated
All Time
Detection languages
1
Contributors
1
Categories
1
Platforms
1
1
Products / Services
1
MITRE Techniques
1
1
CVEs
71
71
64
58
49
Detects the use of the Microsoft Device Console (devcon.exe) to disable VMware Virtual Machine Communication Interface (VMCI) devices. This is a preparatory step observed in the 'MAESTRO' toolkit to gain exclusive hardware access before loading a malicious driver for a VM escape exploit.
