Windows ImageLoad: Uncommon Process Loads RstrtMgr.dll (Restart Manager)

ATT&CK techniques

Impact

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
- T1486Data Encrypted for Impact

What it detects

This rule flags image loads of RstrtMgr.dll (Windows Restart Manager) when performed by a process that is not part of several common, expected Windows or installer-related locations. RstrtMgr.dll can be used to disrupt other processes by coordinating restarts, which may support ransomware-style file encryption or defense-impairment behaviors. It relies on image-load telemetry, matching both the loaded DLL path ending in \RstrtMgr.dll and the OriginalFileName value, while excluding known benign source paths and installer contexts.

Reporting behind it

Related detections9 linkedT1486 — drag to rearrange

Malicious Remote Encryptor Execution via WMIC Process Call Create (Chaos Ransomware)

Suspicious CyberLock Ransomware Encrypted File Creation

Rhysida Ransomware Encrypted File Extension Created

Phobos 8Base Ransomware Encrypted File Extension Created

Rhysida Ransomware Note CriticalBreachDetected.pdf Created

Possible Akira Ransomware Note or Encrypted Extension Creation

Malicious Storm-2603 Ransom Note File Creation

Possible Ransomware Note or Encrypted File Extension Creation

BitLocker Feature Activation on Multiple Hosts - Native (via bitlocker)

Windows ImageLoad: Uncommon Process Loads RstrtMgr.dll (Restart Manager)

Pivot detection · T1486 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-dll-load-of-rstrtmgr-dll-by-uncommon-process-3669afd2

title: "Windows ImageLoad: Uncommon Process Loads RstrtMgr.dll (Restart Manager)"
id: 3f19fc64-51de-451b-8564-adc1a899c0dd
related:
  - id: b48492dc-c5ef-4572-8dff-32bc241c15c8
    type: derived
  - id: 3669afd2-9891-4534-a626-e5cf03810a61
    type: derived
status: test
description: This rule flags image loads of RstrtMgr.dll (Windows Restart Manager) when performed by a process that is not part of several common, expected Windows or installer-related locations. RstrtMgr.dll can be used to disrupt other processes by coordinating restarts, which may support ransomware-style file encryption or defense-impairment behaviors. It relies on image-load telemetry, matching both the loaded DLL path ending in \RstrtMgr.dll and the OriginalFileName value, while excluding known benign source paths and installer contexts.
references:
  - https://www.crowdstrike.com/blog/windows-restart-manager-part-1/
  - https://www.crowdstrike.com/blog/windows-restart-manager-part-2/
  - https://web.archive.org/web/20231221193106/https://www.swascan.com/cactus-ransomware-malware-analysis/
  - https://taiwan.postsen.com/business/88601/Hamas-hackers-use-data-destruction-software-BiBi-which-consumes-a-lot-of-processor-resources-to-wipe-Windows-computer-data--iThome.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_dll_rstrtmgr_uncommon_load.yml
author: Luc Génaux, Huntrule Team
date: 2023-11-28
modified: 2026-07-28
tags:
  - attack.impact
  - attack.defense-impairment
  - attack.t1486
  - attack.t1685
logsource:
  category: image_load
  product: windows
detection:
  selection:
    - ImageLoaded|endswith: \RstrtMgr.dll
    - OriginalFileName: RstrtMgr.dll
  filter_main_generic:
    Image|startswith:
      - C:\$WINDOWS.~BT\
      - C:\$WinREAgent\
      - C:\Program Files (x86)\
      - C:\Program Files\
      - C:\ProgramData\
      - C:\Windows\explorer.exe
      - C:\Windows\SoftwareDistribution\
      - C:\Windows\SysNative\
      - C:\Windows\System32\
      - C:\Windows\SysWOW64\
      - C:\Windows\WinSxS\
      - C:\WUDownloadCache\
  filter_main_user_software_installations:
    Image|startswith: C:\Users\
    Image|contains|all:
      - \AppData\Local\Temp\is-
      - .tmp\
    Image|endswith: .tmp
  filter_main_admin_software_installations:
    Image|startswith: C:\Windows\Temp\
  filter_optional_onedrive_1:
    Image|startswith: C:\Users\
    Image|endswith:
      - \AppData\Local\Microsoft\OneDrive\OneDrive.exe
      - \AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
  filter_optional_onedrive_2:
    Image|startswith: C:\Users\
    Image|contains: \AppData\Local\Microsoft\OneDrive\
    Image|endswith: \OneDrive.Sync.Service.exe
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Other legitimate Windows processes not currently listed
  - Processes related to software installation
level: low
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL