Title:Renamed Vmnat.exe Execution Status:test Description:Detects renamed vmnat.exe or portable version that can be used for DLL side-loading References: -https://twitter.com/malmoeb/status/1525901219247845376 Author: elhoim Date: 2022-09-09 modified:2023-02-03 Tags:
-'attack.privilege-escalation'
-'attack.persistence'
-'attack.execution'
-'attack.stealth'
-'attack.t1574.001'
Logsource:
category: process_creation
product: windows
Detection: selection: OriginalFileName:
'vmnat.exe' filter_rename: Image|endswith:
'vmnat.exe' condition:selection and not 1 of filter_* Falsepositives:
-Unknown Level:high
