avatar

Feliciano Manguele

@Feliciano
Completionist
0 followers11 downloads2 copies0 likes84 views

1 detection

Detects the execution of devcon.exe with command-line arguments to disable the VMware Virtual Machine Communication Interface (VMCI) PCI device or host device driver. Threat actors use this technique to gain direct hardware access as a preparatory step for VM escape exploits.
avatar
Feliciano Manguele@Feliciano
avatar
Detection & Hunting Community
7 months ago
2084