Windows ImageLoad: Uncommon Process Loads RstrtMgr.dll (Restart Manager)

ATT&CK techniques

Impact

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
- T1486Data Encrypted for Impact

What it detects

This rule flags image loads of RstrtMgr.dll (Windows Restart Manager) when performed by a process that is not part of several common, expected Windows or installer-related locations. RstrtMgr.dll can be used to disrupt other processes by coordinating restarts, which may support ransomware-style file encryption or defense-impairment behaviors. It relies on image-load telemetry, matching both the loaded DLL path ending in \RstrtMgr.dll and the OriginalFileName value, while excluding known benign source paths and installer contexts.

Reporting behind it

Related detections9 linkedT1486 — drag to rearrange

Malicious Lynx Ransomware Encryption Execution (via process_creation)

Malicious JADEPUFFER Lockd Encryptor Execution

Suspicious Mass Locked Extension File Creation by Ransomware

Malicious Interlock Ransomware Encrypted File and Note Creation (via file_event)

Malicious Ransomware Encryption Extension x2anylock

Malicious Fivehands Go Encryptor Execution via Command Line Flags

Malicious SafePay Ransomware Encryptor Command-Line Execution

Malicious The Gentlemen Ransomware Encryptor via Distinctive CLI Flags

Malicious GigaWiper Ransomware File Extension .candy

Windows ImageLoad: Uncommon Process Loads RstrtMgr.dll (Restart Manager)

Pivot detection · T1486 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-dll-load-of-rstrtmgr-dll-by-uncommon-process-3669afd2

title: "Windows ImageLoad: Uncommon Process Loads RstrtMgr.dll (Restart Manager)"
id: 3f19fc64-51de-451b-8564-adc1a899c0dd
related:
  - id: b48492dc-c5ef-4572-8dff-32bc241c15c8
    type: derived
  - id: 3669afd2-9891-4534-a626-e5cf03810a61
    type: derived
status: test
description: This rule flags image loads of RstrtMgr.dll (Windows Restart Manager) when performed by a process that is not part of several common, expected Windows or installer-related locations. RstrtMgr.dll can be used to disrupt other processes by coordinating restarts, which may support ransomware-style file encryption or defense-impairment behaviors. It relies on image-load telemetry, matching both the loaded DLL path ending in \RstrtMgr.dll and the OriginalFileName value, while excluding known benign source paths and installer contexts.
references:
  - https://www.crowdstrike.com/blog/windows-restart-manager-part-1/
  - https://www.crowdstrike.com/blog/windows-restart-manager-part-2/
  - https://web.archive.org/web/20231221193106/https://www.swascan.com/cactus-ransomware-malware-analysis/
  - https://taiwan.postsen.com/business/88601/Hamas-hackers-use-data-destruction-software-BiBi-which-consumes-a-lot-of-processor-resources-to-wipe-Windows-computer-data--iThome.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_dll_rstrtmgr_uncommon_load.yml
author: Luc Génaux, Huntrule Team
date: 2023-11-28
modified: 2026-07-28
tags:
  - attack.impact
  - attack.defense-impairment
  - attack.t1486
  - attack.t1685
logsource:
  category: image_load
  product: windows
detection:
  selection:
    - ImageLoaded|endswith: \RstrtMgr.dll
    - OriginalFileName: RstrtMgr.dll
  filter_main_generic:
    Image|startswith:
      - C:\$WINDOWS.~BT\
      - C:\$WinREAgent\
      - C:\Program Files (x86)\
      - C:\Program Files\
      - C:\ProgramData\
      - C:\Windows\explorer.exe
      - C:\Windows\SoftwareDistribution\
      - C:\Windows\SysNative\
      - C:\Windows\System32\
      - C:\Windows\SysWOW64\
      - C:\Windows\WinSxS\
      - C:\WUDownloadCache\
  filter_main_user_software_installations:
    Image|startswith: C:\Users\
    Image|contains|all:
      - \AppData\Local\Temp\is-
      - .tmp\
    Image|endswith: .tmp
  filter_main_admin_software_installations:
    Image|startswith: C:\Windows\Temp\
  filter_optional_onedrive_1:
    Image|startswith: C:\Users\
    Image|endswith:
      - \AppData\Local\Microsoft\OneDrive\OneDrive.exe
      - \AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
  filter_optional_onedrive_2:
    Image|startswith: C:\Users\
    Image|contains: \AppData\Local\Microsoft\OneDrive\
    Image|endswith: \OneDrive.Sync.Service.exe
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Other legitimate Windows processes not currently listed
  - Processes related to software installation
level: low
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL