Devcon Execution Disabling VMware VMCI Device
Detects execution of devcon.exe with commands that disable the VMware Virtual Machine Communication Interface (VMCI) device. This can be legitimate during VMware Tools troubleshooting or driver conflicts, but may also indicate malware attempting to hijack communication with the hardware via the VMCI device. This has been used to facilitate VMware ESXi vulnerability exploits to escape VMs and execute code on the ESXi host.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.
detection:
selection_img:
- Image|endswith: '\devcon.exe'
- OriginalFileName: 'DevCon.exe'
selection_action:
CommandLine|contains: ' disable '
selection_vmci_pci:
CommandLine|contains:
- '15AD&DEV_0740' # VMware VMCI PCI device (Vendor 0x15AD = VMware, Device 0x0740 = VMCI)
- 'VMWVMCIHOSTDEV' # VMware VMCI root host device driver name
condition: all of selection_*Legitimate VMware administration, Tools installation/uninstallation, or troubleshooting driver conflicts.
Automated scripts in virtualized environments for device cleanup.