# Analyzing and Detecting a VMTools Persistence Technique

DevFeed: [Analyzing and Detecting a VMTools Persistence Technique](<https://devfeed.tech/articles/analyzing-and-detecting-a-vmtools-persistence-technique-20503.md>)

Original publisher: [Read original article](<https://bohops.com/2021/10/08/analyzing-and-detecting-a-vmtools-persistence-technique/>)

Author: bohops

Published: 2021-10-08T03:42:18Z

Content type: tutorial

Language: en

Sources: [Bohops](<https://devfeed.tech/sources/bohops.md>)

Topics: [Persistence](<https://devfeed.tech/topics/persistence.md>), [configuration](<https://devfeed.tech/topics/configuration.md>), [Batch file](<https://devfeed.tech/topics/batch-file.md>), [Process](<https://devfeed.tech/topics/process.md>), [Windows](<https://devfeed.tech/topics/windows.md>), [Utility Software](<https://devfeed.tech/topics/utility.md>)

Tags: [batch](<https://devfeed.tech/tags/batch.md>), [configuration](<https://devfeed.tech/tags/configuration.md>), [payload](<https://devfeed.tech/tags/payload.md>), [persistence](<https://devfeed.tech/tags/persistence.md>), [process](<https://devfeed.tech/tags/process.md>), [script](<https://devfeed.tech/tags/script.md>), [uncategorized](<https://devfeed.tech/tags/uncategorized.md>), [utilities](<https://devfeed.tech/tags/utilities.md>), [windows](<https://devfeed.tech/tags/windows.md>)

## AI overview

This article analyzes a VMware Tools persistence technique on Windows virtual machines. It explains how VMwareToolBoxCmd.exe and the tools.conf file can configure batch scripts to run during VM power-state operations, and discusses detection strategies. The demonstrated payload runs as a child process of vmtoolsd.

## Source excerpt

Introduction It is always fun to reexplore previously discovered techniques or pick back on old research that was put on the wayside in hopes to maybe finding something new or different. Recently, I stood up an ESXi server at home and decided to take a quick peak at the VMware directory structure after installing the [...]