Query: Sigma rule for Detects the load of RstrtMgr DLL (Restart Manager) by a suspicious process. This library has been used during ransomware
Matching passage: Sigma rule: Detects the load of RstrtMgr DLL (Restart Manager) by a suspicious process. This library has been used during ransomware. Logsource: windows / image_load. Rule: title: Load Of RstrtMgr.DLL By A Suspicious Process id: b48492dc-c5ef-4572-8dff-32bc241c15c8 related: - id: 3669afd2-9891-4534-a626-e5cf03810a61 type: derived status: test description: 'Detects the load of RstrtMgr DLL (Restart Manager) by a suspicious process. This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows. It could also be used for anti-analysis purposes by shut downing specific processes. ' references: - https://www.crowdstrike.com/blog/windows-restart-manager-part-1/ - https://www.crowdstrike.com/blog/windows-restart-manager-part-2/ - https://web.archive.org/web/20231221193106/https://www.swascan.com/cactus-ransomware-malware-analysis/ - https://taiwan.postsen.com/business/88601/Hamas-hackers-use-data-destruction-software-BiBi-which-consumes-a-lot-of-processor-resources-to-wipe-Windows-computer-data--iThome.html author: Luc Génaux date: 2023-11-28 tags: - attack.impact - attack.defense-impairment - attack.t1486 - attack.t1685 logsource: category: image_load product: windows detection: selection_img: - ImageLoaded|endswith: \RstrtMgr.dll - OriginalFileName: RstrtMgr.dll selection_folders_1: Image|contains: - :\Perflogs\ - :\Users\Public\ - \Temporary Internet selection_folders_2: - Image|contains|all: - :\Users\ - \Favorites\ - Image|contains|all: - :\Users\ - \Favourites\ - Image|contains|all: - :\Users\ - \Contacts\ condition: selection_img and 1 of selection_folders_* falsepositives: - Processes related to software installation level: high
Near-miss passage: Sigma rule: Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application. Logsource: windows / file_event. Rule: title: New Custom Shim Database Created id: ee63c85c-6d51-4d12-ad09-04e25877a947 status: test description: 'Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.011/T1546.011.md#atomic-test-2---new-shim-database-files-created-in-the-default-shim-database-directory - https://www.mandiant.com/resources/blog/fin7-shim-databases-persistence - https://liberty-shell.com/sec/2020/02/25/shim-persistence/ - https://andreafortuna.org/2018/11/12/process-injection-and-persistence-using-application-shimming/ author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2021-12-29 modified: 2023-12-06 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.009 logsource: product: windows category: file_event detection: selection: TargetFilename|contains: - :\Windows\apppatch\Custom\ - :\Windows\apppatch\CustomSDB\ condition: selection falsepositives: - Legitimate custom SHIM installations will also trigger this rule level: medium regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_creation_new_shim_database/info.yml