Windows Image Load of RstrtMgr.dll by Suspicious Path or User Content

ATT&CK techniques

Impact

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
- T1486Data Encrypted for Impact

What it detects

This rule flags Windows processes that load RstrtMgr.dll (Restart Manager) when the DLL image path or loaded content includes specific suspicious locations or user-related directories. Attackers may use Restart Manager to interfere with competing processes, such as preventing file encryption or disrupting system activity, and it can also be leveraged to hinder analysis by targeting running software. The detection relies on image-load telemetry indicating the loaded DLL name (and original file name) plus the full image path containing patterns like Public, Perflogs, Temporary Internet, or user Favorites/Contacts paths.

Reporting behind it

Related detections9 linkedT1486 — drag to rearrange

Malicious Remote Encryptor Execution via WMIC Process Call Create (Chaos Ransomware)

Suspicious CyberLock Ransomware Encrypted File Creation

Rhysida Ransomware Encrypted File Extension Created

Phobos 8Base Ransomware Encrypted File Extension Created

Rhysida Ransomware Note CriticalBreachDetected.pdf Created

Possible Akira Ransomware Note or Encrypted Extension Creation

Malicious Storm-2603 Ransom Note File Creation

Possible Ransomware Note or Encrypted File Extension Creation

BitLocker Feature Activation on Multiple Hosts - Native (via bitlocker)

Windows Image Load of RstrtMgr.dll by Suspicious Path or User Content

Pivot detection · T1486 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

suspicious-image-load-of-rstrtmgr-dll-by-windows-process-b48492dc

title: Windows Image Load of RstrtMgr.dll by Suspicious Path or User Content
id: a8c664f0-b1f1-4d92-b811-d65dd155e327
related:
  - id: 3669afd2-9891-4534-a626-e5cf03810a61
    type: derived
  - id: b48492dc-c5ef-4572-8dff-32bc241c15c8
    type: derived
status: test
description: This rule flags Windows processes that load RstrtMgr.dll (Restart Manager) when the DLL image path or loaded content includes specific suspicious locations or user-related directories. Attackers may use Restart Manager to interfere with competing processes, such as preventing file encryption or disrupting system activity, and it can also be leveraged to hinder analysis by targeting running software. The detection relies on image-load telemetry indicating the loaded DLL name (and original file name) plus the full image path containing patterns like Public, Perflogs, Temporary Internet, or user Favorites/Contacts paths.
references:
  - https://www.crowdstrike.com/blog/windows-restart-manager-part-1/
  - https://www.crowdstrike.com/blog/windows-restart-manager-part-2/
  - https://web.archive.org/web/20231221193106/https://www.swascan.com/cactus-ransomware-malware-analysis/
  - https://taiwan.postsen.com/business/88601/Hamas-hackers-use-data-destruction-software-BiBi-which-consumes-a-lot-of-processor-resources-to-wipe-Windows-computer-data--iThome.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_dll_rstrtmgr_suspicious_load.yml
author: Luc Génaux, Huntrule Team
date: 2023-11-28
tags:
  - attack.impact
  - attack.defense-impairment
  - attack.t1486
  - attack.t1685
logsource:
  category: image_load
  product: windows
detection:
  selection_img:
    - ImageLoaded|endswith: \RstrtMgr.dll
    - OriginalFileName: RstrtMgr.dll
  selection_folders_1:
    Image|contains:
      - :\Perflogs\
      - :\Users\Public\
      - \Temporary Internet
  selection_folders_2:
    - Image|contains|all:
        - :\Users\
        - \Favorites\
    - Image|contains|all:
        - :\Users\
        - \Favourites\
    - Image|contains|all:
        - :\Users\
        - \Contacts\
  condition: selection_img and 1 of selection_folders_*
falsepositives:
  - Processes related to software installation
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL