Sigma rule: Load Of RstrtMgr.DLL By An Uncommon Process

Rule

Title

Load Of RstrtMgr.DLL By An Uncommon Process

Status

test

Level

low

Author

Luc Génaux

Date

2023-11-28

Modified

2026-07-28

File

rules/windows/image_load/image_load_dll_rstrtmgr_uncommon_load.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the load of RstrtMgr DLL (Restart Manager) by an uncommon process.
This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows.
It could also be used for anti-analysis purposes by shut downing specific processes.

Log source

product

windows

category

image_load

Detection

selection:
    - ImageLoaded|endswith: '\RstrtMgr.dll'
    - OriginalFileName: 'RstrtMgr.dll'
filter_main_generic:
    Image|startswith:
        - 'C:\$WINDOWS.~BT\'
        - 'C:\$WinREAgent\'
        - 'C:\Program Files (x86)\'
        - 'C:\Program Files\'
        - 'C:\ProgramData\'
        - 'C:\Windows\explorer.exe'
        - 'C:\Windows\SoftwareDistribution\'
        - 'C:\Windows\SysNative\'
        - 'C:\Windows\System32\'
        - 'C:\Windows\SysWOW64\'
        - 'C:\Windows\WinSxS\'
        - 'C:\WUDownloadCache\'
filter_main_user_software_installations:
    Image|startswith: 'C:\Users\'
    Image|contains|all:
        - '\AppData\Local\Temp\is-'
        - '.tmp\'
    Image|endswith: '.tmp'
filter_main_admin_software_installations:
    Image|startswith: 'C:\Windows\Temp\'
filter_optional_onedrive_1:
    Image|startswith: 'C:\Users\'
    Image|endswith:
        - '\AppData\Local\Microsoft\OneDrive\OneDrive.exe'
        - '\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe'
filter_optional_onedrive_2:
    Image|startswith: 'C:\Users\'
    Image|contains: '\AppData\Local\Microsoft\OneDrive\' # AppData\Local\Microsoft\OneDrive\26.062.0402.0002\OneDrive.Sync.Service.exe
    Image|endswith: '\OneDrive.Sync.Service.exe'
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• Other legitimate Windows processes not currently listed
• Processes related to software installation

Tags

• attack.impact
• attack.defense-impairment
• attack.t1486
• attack.t1685

MITRE ATT&CK ids this rule names

• T1486
• T1685

Related rules

• b48492dc-c5ef-4572-8dff-32bc241c15c8 (derived)

References

• https://www.crowdstrike.com/blog/windows-restart-manager-part-1/
• https://www.crowdstrike.com/blog/windows-restart-manager-part-2/
• https://web.archive.org/web/20231221193106/https://www.swascan.com/cactus-ransomware-malware-analysis/
• https://taiwan.postsen.com/business/88601/Hamas-hackers-use-data-destruction-software-BiBi-which-consumes-a-lot-of-processor-resources-to-wipe-Windows-computer-data--iThome.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/image_load/image_load_dll_rstrtmgr_uncommon_load.yml