Title:
Devcon Execution Disabling VMware VMCI Device
Status:
experimental
Description:Detects execution of devcon.exe with commands that disable the VMware Virtual Machine Communication Interface (VMCI) device.
This can be legitimate during VMware Tools troubleshooting or driver conflicts, but may also indicate malware attempting to hijack communication with the hardware via the VMCI device.
This has been used to facilitate VMware ESXi vulnerability exploits to escape VMs and execute code on the ESXi host.
References:
-https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/devcon
-https://communities.vmware.com/t5/VMware-Workstation-Pro/VMCI-driver-issues/td-p/2866060
-https://github.com/search?q=devcon+disable+VMWVMCIHOSTDEV
-https://huntress.com/blog/esxi-vm-escape-exploit
Author: Matt Anderson, Dray Agha, Anna Pham (Huntress)
Date: 2026-01-02
modified:None
Tags:
- -'attack.persistence'
- -'attack.privilege-escalation'
- -'attack.defense-impairment'
- -'attack.t1543.003'
- -'attack.t1685'
Logsource:
- category: process_creation
- product: windows
Detection:
selection_img:
Image|endswith:
'\devcon.exe'
OriginalFileName:
'DevCon.exe'
selection_action:
CommandLine|contains:
' disable '
selection_vmci_pci:
CommandLine|contains:
-'15AD&DEV_0740'
-'VMWVMCIHOSTDEV'
condition:
all of selection_*
Falsepositives:
-Legitimate VMware administration, Tools installation/uninstallation, or troubleshooting driver conflicts.
-Automated scripts in virtualized environments for device cleanup.
Level:
high
