CL-STA-1062 VNT Tunneling Tool vmwared.exe with Scheduled Task Persistence
Detects the execution of the VNT tunneling tool disguised as a legitimate VMware executable (vmwared.exe) located in C:\ProgramData\VMware\. The rule also identifies the creation of a scheduled task named 'MicrosoftEdgeUpdate' configured to execute the masqueraded binary at user logon with elevated privileges.
Microsoft Sentinel (KQL)
