Suspicious Child Processes Spawned by VMware Tools: An EDR/XDR Detection Blind Spot

How PowerShell executed through VMware Guest Operations bypasses default endpoint detections and how defenders can detect it.