Query: Sigma rule for Detects the load of RstrtMgr DLL (Restart Manager) by an uncommon process. This library has been used during ransomware
Matching passage: Sigma rule: Detects the load of RstrtMgr DLL (Restart Manager) by an uncommon process. This library has been used during ransomware. Logsource: windows / image_load. Rule: title: Load Of RstrtMgr.DLL By An Uncommon Process id: 3669afd2-9891-4534-a626-e5cf03810a61 related: - id: b48492dc-c5ef-4572-8dff-32bc241c15c8 type: derived status: test description: 'Detects the load of RstrtMgr DLL (Restart Manager) by an uncommon process. This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows. It could also be used for anti-analysis purposes by shut downing specific processes. ' references: - https://www.crowdstrike.com/blog/windows-restart-manager-part-1/ - https://www.crowdstrike.com/blog/windows-restart-manager-part-2/ - https://web.archive.org/web/20231221193106/https://www.swascan.com/cactus-ransomware-malware-analysis/ - https://taiwan.postsen.com/business/88601/Hamas-hackers-use-data-destruction-software-BiBi-which-consumes-a-lot-of-processor-resources-to-wipe-Windows-computer-data--iThome.html author: Luc Génaux date: 2023-11-28 modified: 2026-07-28 tags: - attack.impact - attack.defense-impairment - attack.t1486 - attack.t1685 logsource: category: image_load product: windows detection: selection: - ImageLoaded|endswith: \RstrtMgr.dll - OriginalFileName: RstrtMgr.dll filter_main_generic: Image|startswith: - C:\$WINDOWS.~BT\ - C:\$WinREAgent\ - C:\Program Files (x86)\ - C:\Program Files\ - C:\ProgramData\ - C:\Windows\explorer.exe - C:\Windows\SoftwareDistribution\ - C:\Windows\SysNative\ - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ - C:\WUDownloadCache\ filter_main_user_software_installations: Image|startswith: C:\Users\ Image|contains|all: - \AppData\Local\Temp\is- - .tmp\ Image|endswith: .tmp filter_main_admin_software_installations: Image|startswith: C:\Windows\Temp\ filter_optional_onedrive_1: Image|startswith: C:\Users\ Image|endswith: - \AppData\Local\Microsoft\OneDrive\OneDrive.exe - \AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe filter_optional_onedrive_2: Image|startswith: C:\Users\ Image|contains: \AppData\Local\Microsoft\OneDrive\ Image|endswith: \OneDrive.Sync.Service.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Other legitimate Windows processes not currently listed - Processes related to software installation level: low
Near-miss passage: Sigma rule: Detects the execution of UACMe, a tool used for UAC bypasses, via default PE metadata. Logsource: windows / process_creation. Rule: title: HackTool - UACMe Akagi Execution id: d38d2fa4-98e6-4a24-aff1-410b0c9ad177 status: test description: Detects the execution of UACMe, a tool used for UAC bypasses, via default PE metadata references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems), Florian Roth (Nextron Systems) date: 2021-08-30 modified: 2024-11-23 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection_pe: - Product: UACMe - Company: - REvol Corp - APT 92 - UG North - Hazardous Environments - CD Project Rekt - Description: - UACMe main module - Pentesting utility - OriginalFileName: - Akagi.exe - Akagi64.exe selection_img: Image|endswith: - \Akagi64.exe - \Akagi.exe selection_hashes_sysmon: Hashes|contains: - IMPHASH=767637C23BB42CD5D7397CF58B0BE688 - IMPHASH=14C4E4C72BA075E9069EE67F39188AD8 - IMPHASH=3C782813D4AFCE07BBFC5A9772ACDBDC - IMPHASH=7D010C6BB6A3726F327F7E239166D127 - IMPHASH=89159BA4DD04E4CE5559F132A9964EB3 - IMPHASH=6F33F4A5FC42B8CEC7314947BD13F30F - IMPHASH=5834ED4291BDEB928270428EBBAF7604 - IMPHASH=5A8A8A43F25485E7EE1B201EDCBC7A38 - IMPHASH=DC7D30B90B2D8ABF664FBED2B1B59894 - IMPHASH=41923EA1F824FE63EA5BEB84DB7A3E74 - IMPHASH=3DE09703C8E79ED2CA3F01074719906B condition: 1 of selection_* falsepositives: - Unknown level: high