Elastic low deprecated eql

Potential CVE-2025-41244 vmtoolsd LPE Exploitation Attempt

This rule looks for processes that behave like an attacker trying to exploit a known vulnerability in VMware tools (CVE-2025-41244). The vulnerable behavior involves the VMware tools service or its discovery scripts executing other programs to probe their version strings. An attacker can place a malicious program in a writable location (for example /tmp) and have the tools execute it with elevated privileges, resulting in local privilege escalation. The rule flags launches where vmtoolsd or the service discovery scripts start other child processes.

View Source

Detection Logic

process where host.os.type == "linux" and event.type == "start" and
event.action in ("exec", "exec_event", "start", "executed", "process_started", "ProcessRollup2") and
(
  (
    process.parent.name == "vmtoolsd"
  ) or
  (
    process.parent.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and
    ?process.parent.args like ("/*/open-vm-tools/serviceDiscovery/scripts/get-versions.sh")
  )
) and not (
  process.executable == null or
  ?process.parent.args == "--version" or
  process.args like (
    "/etc/vmware-tools/resume-vm-default",
    "/etc/vmware-tools/suspend-vm-default",
    "/sbin/shutdown",
    "/sbin/shutdown*",
    "/etc/vmware-tools/poweroff-vm-default",
    "/etc/vmware-tools/poweroff-vm-default",
    "/bin/touch",
    "/tmp/vmware-administrator_*",
    "/tmp/vmware-root_*",
    "/etc/vmware-tools/scripts/vmware/network",
    "/etc/vmware-tools/poweron-vm-default"
  ) or
  process.executable == "/usr/sbin/unix_chkpwd" or
  ?process.working_directory like ("/var/opt/ds_agent", "/tmp/vmware-root_*/tmpvmware*") or
  process.command_line like ("*/usr/bin/lsb_release*", "*/bin/touch*", "*/tmp/vmware-root_*")
)

Field Validations

Loading…

Comments (0)

Loading comments...