Devcon Execution Disabling VMware VMCI Device

Matt Anderson, Dray Agha, Anna Pham (Huntress)

Detects execution of devcon.exe with commands that disable the VMware Virtual Machine Communication Interface (VMCI) device. This can be legitimate during VMware Tools troubleshooting or driver conflicts, but may also indicate malware attempting to hijack communication with the hardware via the VMCI device. This has been used to facilitate VMware ESXi vulnerability exploits to escape VMs and execute code on the ESXi host.

2026-01-02 00:00:00

None

85f520e7-6f5e-43ca-874c-222e5bf9c0de

attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1543.003 attack.t1562.001

Community Rule

Matt Anderson

Merge PR #5834 from @MATTANDERS0N - Add Devcon and KDU Execution Rules

2026-01-24