Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Renamed Vmnat.exe Execution

Yamato Security Hayabusa@YamatoSecurityHayabusa

•updated Jun 24, 2025•0•4

Detects renamed vmnat.exe or portable version that can be used for DLL side-loading

Sigma

Tags

TA0005 - Defense Evasion T1574.001 - DLL TA0003 - Persistence TA0004 - Privilege Escalation Process Creation Windowsattack.defense-evasionattack.t1574.001sysmon

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?