Windows vmnat.exe Renamed Execution for Possible DLL Side-Loading

title: Windows vmnat.exe Renamed Execution for Possible DLL Side-Loading
id: d65a4c70-2479-4b70-9abc-0ecbfb47f5de
status: test
description: This rule flags process creation events where an executable image ending in "vmnat.exe" was renamed from the original file name identifier "vmnat.exe". Renamed binaries can be used to disguise execution and potentially facilitate DLL side-loading by launching a trusted-looking executable under an altered name. The detection relies on Windows process creation telemetry and the executable file metadata fields indicating the original file name versus the observed image name.
references:
  - https://twitter.com/malmoeb/status/1525901219247845376
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_renamed_vmnat.yml
author: elhoim, Huntrule Team
date: 2022-09-09
modified: 2023-02-03
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    OriginalFileName: vmnat.exe
  filter_rename:
    Image|endswith: vmnat.exe
  condition: selection and not 1 of filter_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 7b4f794b-590a-4ad4-ba18-7964a2832205
    type: derived