CL-STA-1062 AppDomainManager Injection via chrome_setup.zip Dropping MyAppDomainManager.dll
This rule detects the execution of processes associated with VMware or suspicious files mimicking legitimate VMware components, particularly when spawned from web servers (w3wp.exe) or command-line interpreters (cmd.exe, powershell.exe). It monitors for specific file names and paths that may indicate persistence, lateral movement, or evasion attempts involving VMware-related binaries or configurations.
Cortex XDR
