Windows Image Load of RstrtMgr.dll by Suspicious Path or User Content
Alerts on RstrtMgr.dll loading from suspicious path contexts using Windows image load telemetry.
- Product
- windows
- Category
- image_load
- Author
- Luc Génaux (SigmaHQ), DRL 1.1
- Published
- 2023-11-28
- Updated
- 2026-07-31
ATT&CK techniques
ImpactRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
What it detects
This rule flags Windows processes that load RstrtMgr.dll (Restart Manager) when the DLL image path or loaded content includes specific suspicious locations or user-related directories. Attackers may use Restart Manager to interfere with competing processes, such as preventing file encryption or disrupting system activity, and it can also be leveraged to hinder analysis by targeting running software. The detection relies on image-load telemetry indicating the loaded DLL name (and original file name) plus the full image path containing patterns like Public, Perflogs, Temporary Internet, or user Favorites/Contacts paths.
Reporting behind it
- crowdstrike.comhttps://www.crowdstrike.com/blog/windows-restart-manager-part-1/
- crowdstrike.comhttps://www.crowdstrike.com/blog/windows-restart-manager-part-2/
- web.archive.orghttps://web.archive.org/web/20231221193106/https://www.swascan.com/cactus-ransomware-malware-analysis/
- taiwan.postsen.comhttps://taiwan.postsen.com/business/88601/Hamas-hackers-use-data-destruction-software-BiBi-which-consumes-a-lot-of-processor-resources-to-wipe-Windows-computer-data--iThome.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_dll_rstrtmgr_suspicious_load.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Image Load of RstrtMgr.dll by Suspicious Path or User Content
id: a8c664f0-b1f1-4d92-b811-d65dd155e327
related:
- id: 3669afd2-9891-4534-a626-e5cf03810a61
type: derived
- id: b48492dc-c5ef-4572-8dff-32bc241c15c8
type: derived
status: test
description: This rule flags Windows processes that load RstrtMgr.dll (Restart Manager) when the DLL image path or loaded content includes specific suspicious locations or user-related directories. Attackers may use Restart Manager to interfere with competing processes, such as preventing file encryption or disrupting system activity, and it can also be leveraged to hinder analysis by targeting running software. The detection relies on image-load telemetry indicating the loaded DLL name (and original file name) plus the full image path containing patterns like Public, Perflogs, Temporary Internet, or user Favorites/Contacts paths.
references:
- https://www.crowdstrike.com/blog/windows-restart-manager-part-1/
- https://www.crowdstrike.com/blog/windows-restart-manager-part-2/
- https://web.archive.org/web/20231221193106/https://www.swascan.com/cactus-ransomware-malware-analysis/
- https://taiwan.postsen.com/business/88601/Hamas-hackers-use-data-destruction-software-BiBi-which-consumes-a-lot-of-processor-resources-to-wipe-Windows-computer-data--iThome.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_dll_rstrtmgr_suspicious_load.yml
author: Luc Génaux, Huntrule Team
date: 2023-11-28
tags:
- attack.impact
- attack.defense-impairment
- attack.t1486
- attack.t1685
logsource:
category: image_load
product: windows
detection:
selection_img:
- ImageLoaded|endswith: \RstrtMgr.dll
- OriginalFileName: RstrtMgr.dll
selection_folders_1:
Image|contains:
- :\Perflogs\
- :\Users\Public\
- \Temporary Internet
selection_folders_2:
- Image|contains|all:
- :\Users\
- \Favorites\
- Image|contains|all:
- :\Users\
- \Favourites\
- Image|contains|all:
- :\Users\
- \Contacts\
condition: selection_img and 1 of selection_folders_*
falsepositives:
- Processes related to software installation
level: high
license: DRL-1.1