Lindnor backdoor service masquerading as Chrome component or VMware binary

ills3c Intel&Coffee@Ills3C

•updated 2 days ago•1•0•3

Detects the execution or installation of known Lindnor backdoor binaries (such as healthcontroller64.exe, svchelper.exe, powerhost.exe, eventwatcher.exe, volumeproxy.exe) running as a service or with a service image path set within masqueraded folders like Chrome, Unpacker, or VMware.