Renamed Vmnat.exe Execution for Evasion or DLL Side-Loading
This rule detects the execution of 'vmnat.exe' when its filename has been changed. Adversaries may rename legitimate executables to evade detection, especially when attempting DLL side-loading. The rule specifically looks for processes where the original filename is 'vmnat.exe' but the executed image file path does not end with 'vmnat.exe'. This behavior could indicate an attempt to leverage a legitimate, signed executable for malicious purposes, such as DLL side-loading, where a malicious DLL is placed in the same directory as the renamed legitimate executable.
Sigma
