Rule Info
Name
VMware Binary Masquerading
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Description
Detects execution of binaries using VMware-related filenames but are not the legitimate VMware binaries. This may indicate an attempt to masquerade malicious binaries as VMware components to evade detection.
Date
2026-07-05 00:00:00
Modified
None
Id
f3a9c7e1-2b84-4d5f-96e2-8c1d7b3a5f09
Tags
attack.stealth attack.t1036.005
Type
Nextron Sigma feed only (private)
Rule History
Scan your endpoints, forensic images or collected files with our portable scanner THOR