← Back to SOC feed Coverage →

Suspicious process event creation from VMWare Horizon TomcatService

kql MEDIUM Azure-Sentinel
DeviceProcessEvents
exploithuntingmicrosoftofficial
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-05-05T11:00:00Z · Confidence: medium

Hunt Hypothesis

A malicious actor may be using the ws_TomcatService.exe process from VMware Horizon to execute arbitrary code and establish persistence within the environment. SOC teams should proactively hunt for this behavior as it indicates potential exploitation of the Log4J vulnerability to escalate privileges and deploy malware.

KQL Query

DeviceProcessEvents
| where InitiatingProcessFileName has "ws_TomcatService.exe"
| where FileName != "repadmin.exe"

Analytic Rule Definition

id: afa7c7b7-7d1f-4898-9daf-b35500ff8f2f
name: Suspicious process event creation from VMWare Horizon TomcatService
description: |
  Microsoft has observed attackers who have gained entry to an environment via the Log4J vulnerability utilizing the ws_TomcatService.exe process to launch malicious processes.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Execution
- Vulnerability
query: |
  DeviceProcessEvents
  | where InitiatingProcessFileName has "ws_TomcatService.exe"
  | where FileName != "repadmin.exe"

Required Data Sources

Sentinel TableNotes
DeviceProcessEventsEnsure this data connector is enabled

MITRE ATT&CK Context

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Campaigns/Log4J/Suspicious process event creation from VMWare Horizon TomcatService.yaml