huntrule

Windows Image Load of RstrtMgr.dll by Suspicious Path or User Content

Alerts on RstrtMgr.dll loading from suspicious path contexts using Windows image load telemetry.

FreeReviewedSigma · High · v2
Product
windows
Category
image_load
Author
Luc Génaux (SigmaHQ), DRL 1.1
Published
2023-11-28
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Impact

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows processes that load RstrtMgr.dll (Restart Manager) when the DLL image path or loaded content includes specific suspicious locations or user-related directories. Attackers may use Restart Manager to interfere with competing processes, such as preventing file encryption or disrupting system activity, and it can also be leveraged to hinder analysis by targeting running software. The detection relies on image-load telemetry indicating the loaded DLL name (and original file name) plus the full image path containing patterns like Public, Perflogs, Temporary Internet, or user Favorites/Contacts paths.

Reporting behind it

Related detections9 linkedT1486 — drag to rearrange
Malicious Backup and Recovery Destruction Chain via Dire Wolf Ransomware (via process_creation)
Malicious Dire Wolf Ransomware Encrypted File Extension on Disk (via file_event)
Malicious Lynx Ransomware Encryption Execution (via process_creation)
Malicious JADEPUFFER Lockd Encryptor Execution
Suspicious Mass Locked Extension File Creation by Ransomware
Malicious Interlock Ransomware Encrypted File and Note Creation (via file_event)
Malicious Ransomware Encryption Extension x2anylock
Malicious Fivehands Go Encryptor Execution via Command Line Flags
Malicious SafePay Ransomware Encryptor Command-Line Execution
Windows Image Load of RstrtMgr.dll by Suspicious Path or User Content
Pivot detection · T1486 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.