Sigma rule: Load Of RstrtMgr.DLL By A Suspicious Process

Rule

Title

Load Of RstrtMgr.DLL By A Suspicious Process

Status

test

Level

high

Author

Luc Génaux

Date

2023-11-28

File

rules/windows/image_load/image_load_dll_rstrtmgr_suspicious_load.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the load of RstrtMgr DLL (Restart Manager) by a suspicious process.
This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows.
It could also be used for anti-analysis purposes by shut downing specific processes.

Log source

product

windows

category

image_load

Detection

selection_img:
    - ImageLoaded|endswith: '\RstrtMgr.dll'
    - OriginalFileName: 'RstrtMgr.dll'
selection_folders_1:
    Image|contains:
        # Note: increase coverage by adding more suspicious paths
        - ':\Perflogs\'
        - ':\Users\Public\'
        - '\Temporary Internet'
selection_folders_2:
    - Image|contains|all:
          - ':\Users\'
          - '\Favorites\'
    - Image|contains|all:
          - ':\Users\'
          - '\Favourites\'
    - Image|contains|all:
          - ':\Users\'
          - '\Contacts\'
condition: selection_img and 1 of selection_folders_*

False positives (as the rule lists them)

• Processes related to software installation

Tags

• attack.impact
• attack.defense-impairment
• attack.t1486
• attack.t1685

MITRE ATT&CK ids this rule names

• T1486
• T1685

Related rules

• 3669afd2-9891-4534-a626-e5cf03810a61 (derived)

References

• https://www.crowdstrike.com/blog/windows-restart-manager-part-1/
• https://www.crowdstrike.com/blog/windows-restart-manager-part-2/
• https://web.archive.org/web/20231221193106/https://www.swascan.com/cactus-ransomware-malware-analysis/
• https://taiwan.postsen.com/business/88601/Hamas-hackers-use-data-destruction-software-BiBi-which-consumes-a-lot-of-processor-resources-to-wipe-Windows-computer-data--iThome.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/image_load/image_load_dll_rstrtmgr_suspicious_load.yml