{
	"VMWare Tools Registry Machine Key": {
		"description": "Check if `HKLM\\SOFTWARE\\VMware, Inc.\\VMware Tools' Registry Key is present.",
		"countermeasures": "Remove `HKLM\\SOFTWARE\\VMware, Inc.\\VMware Tools' Registry Key.",
		"type": "registry",
		"enabled": "yes",
		"arguments": {
			"check": "exists",
			"hkey": "HKLM",
			"key": "SOFTWARE\\VMware, Inc.\\VMware Tools"
		},
		"score": 10
	},
	"VMWare Tools Registry User Key": {
		"description": "Check if `HKCU\\SOFTWARE\\VMware, Inc.\\VMware Tools' Registry Key is present.",
		"countermeasures": "Remove `HKCU\\SOFTWARE\\VMware, Inc.\\VMware Tools' Registry Key.",
		"type": "registry",
		"enabled": "yes",
		"arguments": {
			"check": "exists",
			"hkey": "HKCU",
			"key": "SOFTWARE\\VMware, Inc.\\VMware Tools"
		},
		"score": 10
	},
	"VMWare Service Registry Key": {
		"description": "Check if one of the following SubKeys are present under `HKLM\\SYSTEM\\ControlSet001\\Services\\' Key: `vmdebug', `vmmouse', `VMTools', `VMMEMCTL', `vmware', `vmci', `vmx86', `vmxnet', `vmx_svga'.",
		"countermeasures": "Remove the following SubKeys under `HKLM\\SYSTEM\\ControlSet001\\Services\\' key: `vmdebug', `vmmouse', `VMTools', `VMMEMCTL', `vmware', `vmci', `vmx86', `vmxnet', `vmx_svga'.",
		"type": "registry",
		"enabled": "yes",
		"arguments": {
			"check": "exists",
			"hkey": "HKLM",
			"key": [
				"SYSTEM\\ControlSet001\\Services\\vmdebug",
				"SYSTEM\\ControlSet001\\Services\\vmmouse",
				"SYSTEM\\ControlSet001\\Services\\VMTools",
				"SYSTEM\\ControlSet001\\Services\\VMMEMCTL",
				"SYSTEM\\ControlSet001\\Services\\vmware",
				"SYSTEM\\ControlSet001\\Services\\vmci",
				"SYSTEM\\ControlSet001\\Services\\vmx86",
				"SYSTEM\\ControlSet001\\Services\\vmxnet",
				"SYSTEM\\ControlSet001\\Services\\vmx_svga"
			]
		},
		"score": 10
	},
	"ScsiPort0 Registry Key": {
		"description": "Check if `HKLM\\HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0' Registry Key has value `Identifier'=`VMWARE'.",
		"countermeasures": "Patch the content of `HKLM\\HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0' Registry Key value `Identifier'.",
		"type": "registry",
		"enabled": "yes",
		"arguments": {
			"check": "contains",
			"hkey": "HKLM",
			"key": "HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0",
			"value_name": "Identifier",
			"value_data": "VMWARE"
		},
		"score": 7
	},
	"ScsiPort1 Registry Key": {
		"description": "Check if `HKLM\\HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 1\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0' Registry Key has value `Identifier'=`VMWARE'.",
		"countermeasures": "Patch the content of `HKLM\\HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 1\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0' Registry Key value `Identifier'.",
		"type": "registry",
		"enabled": "yes",
		"arguments": {
			"check": "contains",
			"hkey": "HKLM",
			"key": "HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 1\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0",
			"value_name": "Identifier",
			"value_data": "VMWARE"
		},
		"score": 7
	},
	"ScsiPort2 Registry Key": {
		"description": "Check if `HKLM\\HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 2\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0' Registry Key has value `Identifier'=`VMWARE'.",
		"countermeasures": "Patch the content of `HKLM\\HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 2\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0' Registry Key value `Identifier'.",
		"type": "registry",
		"enabled": "yes",
		"arguments": {
			"check": "contains",
			"hkey": "HKLM",
			"key": "HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 2\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0",
			"value_name": "Identifier",
			"value_data": "VMWARE"
		},
		"score": 7
	},
	"DiskIdentifier Registry Key": {
		"description": "Check if `HKLM\\SYSTEM\\ControlSet001\\Services\\Disk\\Enum' Registry Key has values `0'=`VMware' and/or `1'=`VMware'.",
		"countermeasures": "Patch the content of `HKLM\\SYSTEM\\ControlSet001\\Services\\Disk\\Enum' Registry Key values `0' and/or `1'.",
		"type": "registry",
		"enabled": "yes",
		"arguments": {
			"check": "contains",
			"hkey": "HKLM",
			"key": "SYSTEM\\ControlSet001\\Services\\Disk\\Enum",
			"value_name": ["0", "1"],
			"value_data": "VMware"
		},
		"score": 7
	},
	"Driver Description Registry Keys": {
		"description": "Check if `SYSTEM\\ControlSet001\\Control\\Class\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000' Registry Keys contain values `VMware' and/or `vmx' in registry items `CoInstallers32', `DriverDesc', `InfSection', `ProviderName'.",
		"countermeasures": "Patch the content of `SYSTEM\\ControlSet001\\Control\\Class\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000' Registry Key values `CoInstallers32', `DriverDesc', `InfSection', and `ProviderName'.",
		"type": "registry",
		"enabled": "yes",
		"arguments": {
			"check": "contains",
			"hkey": "HKLM",
			"key": "SYSTEM\\ControlSet001\\Control\\Class\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000",
			"value_name": ["CoInstallers32", "DriverDesc", "InfSection", "ProviderName"],
			"value_data": ["VMware", "vmx"]
		},
		"score": 4
	},
	"ControlSet001 Registry Key": {
		"description": "Check if `HKLM\\SYSTEM\\ControlSet001\\Enum' Registry Key has values `DeviceDesc'=`VMware' and/or `FriendlyName'=`VMware' recursively.",
		"countermeasures": "Patch the content of `HKLM\\SYSTEM\\ControlSet001\\Enum' Registry Key values `DeviceDesc' and/or `FriendlyName' recursively.",
		"type": "registry",
		"enabled": "yes",
		"arguments": {
			"check": "contains",
			"recursive": "yes",
			"hkey": "HKLM",
			"key": "SYSTEM\\ControlSet001\\Enum",
			"value_name": ["DeviceDesc", "FriendlyName"],
			"value_data": "VMware"
		},
		"score": 7
	},
	"ControlSet002 Registry Key": {
		"description": "Check if `HKLM\\SYSTEM\\ControlSet002\\Enum' Registry Key has values `DeviceDesc'=`VMware' and/or `FriendlyName'=`VMware' recursively.",
		"countermeasures": "Patch the content of `HKLM\\SYSTEM\\ControlSet002\\Enum' Registry Key values `DeviceDesc' and/or `FriendlyName' recursively.",
		"type": "registry",
		"enabled": "yes",
		"arguments": {
			"check": "contains",
			"recursive": "yes",
			"hkey": "HKLM",
			"key": "SYSTEM\\ControlSet002\\Enum",
			"value_name": ["DeviceDesc", "FriendlyName"],
			"value_data": "VMware"
		},
		"score": 7
	},
	"ControlSet003 Registry Key": {
		"description": "Check if `HKLM\\SYSTEM\\ControlSet003\\Enum' Registry Key has values `DeviceDesc'=`VMware' and/or `FriendlyName'=`VMware' recursively.",
		"countermeasures": "Patch the content of `HKLM\\SYSTEM\\ControlSet003\\Enum' Registry Key values `DeviceDesc' and/or `FriendlyName' recursively.",
		"type": "registry",
		"enabled": "yes",
		"arguments": {
			"check": "contains",
			"recursive": "yes",
			"hkey": "HKLM",
			"key": "SYSTEM\\ControlSet003\\Enum",
			"value_name": ["DeviceDesc", "FriendlyName"],
			"value_data": "VMware"
		},
		"score": 7
	},
	"ProductsInstaller Registry Key": {
		"description": "Check if `HKCR\\Installer\\Products' Registry Key has value `ProductName'=`vmware tools' recursively.",
		"countermeasures": "Patch the content of `HKCR\\Installer\\Products' Registry Key value `ProductName' recursively.",
		"type": "registry",
		"enabled": "yes",
		"arguments": {
			"check": "contains",
			"recursive": "yes",
			"hkey": "HKCR",
			"key": "Installer\\Products",
			"value_name": "ProductName",
			"value_data": "vmware tools"
		},
		"score": 4
	},	
	"ProductsUninstaller Registry Key (CurrentUser)": {
		"description": "Check if `HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall' Registry Key has value `DisplayName'=`vmware tools' recursively.",
		"countermeasures": "Patch the content of `HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall' Registry Key value `DisplayName' recursively.",
		"type": "registry",
		"enabled": "yes",
		"arguments": {
			"check": "contains",
			"recursive": "yes",
			"hkey": "HKCU",
			"key": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall",
			"value_name": "DisplayName",
			"value_data": "vmware tools"
		},
		"score": 4
	},
	"ProductsUninstaller Registry Key (LocalMachine)": {
		"description": "Check if `HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall' Registry Key has value `DisplayName'=`vmware tools' recursively.",
		"countermeasures": "Patch the content of `HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall' Registry Key value `DisplayName' recursively.",
		"type": "registry",
		"enabled": "yes",
		"arguments": {
			"check": "contains",
			"recursive": "yes",
			"hkey": "HKLM",
			"key": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall",
			"value_name": "DisplayName",
			"value_data": "vmware tools"
		},
		"score": 4
	},
	"SystemBiosVersion Registry Key": {
		"description": "Check if `HKLM\\HARDWARE\\Description\\System' Registry Key has value `SystemBiosVersion'=`VMWARE' or `SystemBiosVersion'=`INTEL  - 6040000'.",
		"countermeasures": "Patch the content of `HKLM\\HARDWARE\\Description\\System' Registry Key value `SystemBiosVersion'.",
		"type": "registry",
		"enabled": "yes",
		"arguments": {
			"check": "contains",
			"hkey": "HKLM",
			"key": "HARDWARE\\Description\\System",
			"value_name": "SystemBiosVersion",
			"value_data": ["INTEL  - 6040000", "VMWARE"]
		},
		"score": 9
	},
	"VideoBiosVersion Registry Key": {
		"description": "Check if `HKLM\\HARDWARE\\Description\\System' Registry Key has value `VideoBiosVersion'=`VMWARE'.",
		"countermeasures": "Patch the content of `HKLM\\HARDWARE\\Description\\System' Registry Key value `VideoBiosVersion'.",
		"type": "registry",
		"enabled": "yes",
		"arguments": {
			"check": "contains",
			"hkey": "HKLM",
			"key": "HARDWARE\\Description\\System",
			"value_name": "VideoBiosVersion",
			"value_data": "VMWARE"
		},
		"score": 9
	},
	"EnumPCI Registry SubKey": {
		"description": "Check if `HKLM\\SYSTEM\\CurrentControlSet\\Enum\\PCI' Registry Key has SubKey that contains `VEN_15AD'.",
		"countermeasures": "Patch the name of `HKLM\\SYSTEM\\CurrentControlSet\\Enum\\PCI' Registry Key SubKey that contains `VEN_15AD'.",
		"type": "registry",
		"enabled": "yes",
		"arguments": {
			"check": "enum_keys",
			"hkey": "HKLM",
			"key": "SYSTEM\\CurrentControlSet\\Enum\\PCI",
			"subkey": "VEN_15AD"
		},
		"score": 4
	},
	"EnumIDE Registry SubKey": {
		"description": "Check if `HKLM\\SYSTEM\\CurrentControlSet\\Enum\\IDE' Registry Key has SubKey that contains `CdRomNECVMWar' or `DiskVMware'.",
		"countermeasures": "Patch the name of `HKLM\\SYSTEM\\CurrentControlSet\\Enum\\IDE' Registry Key SubKey that contains `CdRomNECVMWar' or `DiskVMware'.",
		"type": "registry",
		"enabled": "yes",
		"arguments": {
			"check": "enum_keys",
			"hkey": "HKLM",
			"key": "HKLM\\SYSTEM\\CurrentControlSet\\Enum\\IDE",
			"subkey": [
				"CdRomNECVMWar",
				"DiskVMware"
			]
		},
		"score": 6
	},
	"VMWare Device HGFS": {
		"description": "Check if the following devices is present: `\\\\.\\HGFS'.",
		"countermeasures": "Stop specific service.",
		"type": "device",
		"enabled": "yes",
		"arguments": {
			"name": "\\\\.\\HGFS"
		},
		"score": 8
	},
	"VMWare Device vmci": {
		"description": "Check if the following devices is present: `\\\\.\\vmci'.",
		"countermeasures": "Stop specific service.",
		"type": "device",
		"enabled": "yes",
		"arguments": {
			"name": "\\\\.\\vmci"
		},
		"score": 8
	},
	"VMWare Files": {
		"description": "Check if the following files are present in the `C:\\WINDOWS\\system32' folder: `hgfs.sys', `vmhgfs.sys'. Check if the following files are present in the `C:\\WINDOWS\\system32\\drivers' folder: `vmmouse.sys', `vmnet.sys', `vmxnet.sys', `vmhgfs.sys', `vmx86.sys'. Check if `C:\\program files\\VMware\\' directory is present.",
		"countermeasures": "Exclude files from enumeration using filter driver. Hook GetFileAttributes function to return appropriate result.",
		"type": "file",
		"enabled": "yes",
		"arguments": {
			"name": [
				"C:\\WINDOWS\\system32\\drivers\\vmmouse.sys",
				"C:\\WINDOWS\\system32\\drivers\\vmnet.sys",
				"C:\\WINDOWS\\system32\\drivers\\vmxnet.sys",
				"C:\\WINDOWS\\system32\\drivers\\vmhgfs.sys",
				"C:\\WINDOWS\\system32\\drivers\\vmx86.sys",
				"C:\\Windows\\system32\\hgfs.sys",
				"C:\\Windows\\system32\\vmhgfs.sys",
				"C:\\program files\\VMware\\"
			]
		},
		"score": 10
	},
	"VMWare Processes": {
		"description": "Check if one of the following processes is running: `vmtoolsd.exe', `vmacthlp.exe', `vmwaretray.exe', `vmwareuser.exe', `vmware.exe', `vmount2.exe'.",
		"countermeasures": "Exclude `vmtoolsd.exe', `vmacthlp.exe', `vmwaretray.exe', `vmwareuser.exe', `vmware.exe', `vmount2.exe' processes from enumeration or terminate them.",
		"type": "process",
		"enabled": "yes",
		"arguments": {
			"name": [
				"vmtoolsd.exe",
				"vmacthlp.exe",
				"vmwaretray.exe",
				"vmwareuser.exe",
				"vmware.exe",
				"vmount2.exe"
			]
		},
		"score": 10
	},
	"Forbidden MACs": {
		"description": "Check if MAC vendor is one of the following ones: `000569', `000C29', `001C14', `005056'.",
		"countermeasures": "Change MAC address for the virtual machine.",
		"type": "mac",
		"enabled": "yes",
		"arguments": {
			"vendor": ["000569", "000C29", "001C14", "005056"]
		},
		"score": 6
	},
	"Adapter": {
		"description": "Check if adapter name contains the following identifier: `VMWare'.",
		"countermeasures": "Multiple.",
		"type": "adapter",
		"enabled": "yes",
		"arguments": {
			"name": "VMWare"
		},
		"score": 6
	},
	"FirmwareRaw Table": {
		"description": "Check if raw firmware table content contains the following identifier: `VMware'.",
		"countermeasures": "On systems older than Vista change memory content of Csrss.exe. On Vista and higher systems hook NtQuerySystemInformation for SystemFirmwareTableInformation class and parse SFTI structure.",
		"type": "firmware",
		"enabled": "yes",
		"arguments": {
			"check": "firm",
			"name": "VMware"
		},
		"score": 7
	},
	"FirmwareSMBIOS Table": {
		"description": "Check if SMBIOS firmware table content contains the following identifier: `VMware'.",
		"countermeasures": "On systems older than Vista change memory content of Csrss.exe. On Vista and higher systems hook NtQuerySystemInformation for SystemFirmwareTableInformation class and parse SFTI structure.",
		"type": "firmware",
		"enabled": "yes",
		"arguments": {
			"check": "rsmb",
			"name": "VMware"
		},
		"score": 7
	},
	"Directory Device Object": {
		"description": "Check if specific directory object `\\Device' contains the following object: `vmmemctl'.",
		"countermeasures": "Stop specific service.",
		"type": "object",
		"enabled": "yes",
		"arguments": {
			"directory" : "\\Device",
			"name": "vmmemctl"
		},
		"score": 8
	},
	"VMWare HypervisorID": {
		"description": "Check if processor HypervisorID does not equal to: `VMwareVMware'.",
		"countermeasures": "cpuid instruction mask.",
		"type": "cpuid_h",
		"enabled": "yes",
		"arguments": {
			"vendor": ["VMwareVMware"]
		},
		"score": 10
	},
	"VMWare Disk Name": {
		"description": "Check if disk name does not contain the following identifiers: `VMware'.",
		"countermeasures": "Multiple.",
		"type": "disk",
		"enabled": "yes",
		"arguments": {
			"name": "VMware"
		},
		"score": 8
	},
	"VMWare Drive Model": {
		"description": "Check if drive model does not contain the following identifiers: `VMware'.",
		"countermeasures": "Filter specific IOCTLs: DFP_RECEIVE_DRIVE_DATA (SMART_RCV_DRIVE_DATA), IOCTL_STORAGE_QUERY_PROPERTY.",
		"type": "drive_model",
		"enabled": "yes",
		"arguments": {
			"name": "VMware"
		},
		"score": 5
	},
	"HypervisorPort": {
		"description": "Check if hypervisor port returns specific value.",
		"countermeasures": "Disable hypervisor port.",
		"type": "custom",
		"enabled": "yes",
		"score": 10
	},
	"HypervisorPortEnum": {
		"description": "Enum hypervisor port commands and check if #GP exception is not raised.",
		"countermeasures": "Restrict backdoor usage.",
		"type": "custom",
		"enabled": "yes",
		"score": 5
	},
	"HypervisorBit": {
		"description": "Check if hypervisor bit is enabled.",
		"countermeasures": "cpuid instruction mask.",
		"enabled": "yes",
		"score": 10
	},
	"VMWare DiskEnum Registry Key": {
		"description": "Check if `System\\CurrentControlSet\\Services\\Disk\\Enum' Registry Key has value `0'=`*vmware*'.",
		"countermeasures": "Patch the registry to hide this indicator",
		"type": "registry",
		"enabled": "yes",
		"arguments": {
			"check": "contains",
			"hkey": "HKLM",
			"key": "System\\CurrentControlSet\\Services\\Disk\\Enum",
			"value_name": "0",
			"value_data": "vmware"
		},
		"score": 10
	},
	"VMWare Physical Display Adapter VendorId": {
		"description": "Check if vendor ID of physical display adapter matches the one used in VMWare.",
		"countermeasures": "Set up hook on a function `GetAdapterIdentifier` from `d3d9.dll`, check if the queried adapter is related to DirectX and replace return values.",
		"type": "display_adapter",
		"enabled": "yes",
		"arguments": {
			"value_name": "VendorId",
			"value_data": "0x15AD"
		},
		"score": 7
	},
	"VMWare Physical Display Adapter DeviceId": {
		"description": "Check if device ID of physical display adapter matches the one used in VMWare (must be used in combination with VendorId check).",
		"countermeasures": "Set up hook on a function `GetAdapterIdentifier` from `d3d9.dll`, check if the queried adapter is related to DirectX and replace return values.",
		"type": "display_adapter",
		"enabled": "yes",
		"arguments": {
			"value_name": "DeviceId",
			"value_data": "0x405"
		},
		"score": 7
	},
	"VMWare Physical Display Adapter Driver": {
		"description": "Check if driver for physical display adapter matches one of used in VMWare.",
		"countermeasures": "Set up hook on a function `GetAdapterIdentifier` from `d3d9.dll`, check if the queried adapter is related to DirectX and replace return values.",
		"type": "display_adapter",
		"enabled": "yes",
		"arguments": {
			"value_name": "Driver",
			"value_data": ["vm3dum.dll", "vm3dum64_loader.dll"]
		},
		"score": 7
	},
	"VMWare Physical Display Adapter Description": {
		"description": "Check if description of physical display adapter matches the one used in VMWare.",
		"countermeasures": "Set up hook on a function `GetAdapterIdentifier` from `d3d9.dll`, check if the queried adapter is related to DirectX and replace return values.",
		"type": "display_adapter",
		"enabled": "yes",
		"arguments": {
			"value_name": "Description",
			"value_data": "VMware SVGA 3D"
		},
		"score": 7
	}
}