{"id":"b48492dc-c5ef-4572-8dff-32bc241c15c8","title":"Load Of RstrtMgr.DLL By A Suspicious Process","description":"Detects the load of RstrtMgr DLL (Restart Manager) by a suspicious process.\nThis library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows.\nIt could also be used for anti-analysis purposes by shut downing specific processes.\n","author":"Luc Génaux","status":"test","level":"high","date":"2023-11-28","modified":"","tags":["attack.impact","attack.defense-impairment","attack.t1486","attack.t1685"],"technique_ids":["T1486","T1685"],"logsource":{"category":"image_load","product":"windows"},"falsepositives":["Processes related to software installation"],"references":["https://www.crowdstrike.com/blog/windows-restart-manager-part-1/","https://www.crowdstrike.com/blog/windows-restart-manager-part-2/","https://web.archive.org/web/20231221193106/https://www.swascan.com/cactus-ransomware-malware-analysis/","https://taiwan.postsen.com/business/88601/Hamas-hackers-use-data-destruction-software-BiBi-which-consumes-a-lot-of-processor-resources-to-wipe-Windows-computer-data--iThome.html"],"source_path":"rules/windows/image_load/image_load_dll_rstrtmgr_suspicious_load.yml","source_sha256":"255bdf1c371a289bd35225247957ac34b58ccc3de5e10d63876665575c464301","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/image_load/image_load_dll_rstrtmgr_suspicious_load.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Load Of RstrtMgr.DLL By A Suspicious Process\nid: b48492dc-c5ef-4572-8dff-32bc241c15c8\nrelated:\n    - id: 3669afd2-9891-4534-a626-e5cf03810a61\n      type: derived\nstatus: test\ndescription: |\n    Detects the load of RstrtMgr DLL (Restart Manager) by a suspicious process.\n    This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows.\n    It could also be used for anti-analysis purposes by shut downing specific processes.\nreferences:\n    - https://www.crowdstrike.com/blog/windows-restart-manager-part-1/\n    - https://www.crowdstrike.com/blog/windows-restart-manager-part-2/\n    - https://web.archive.org/web/20231221193106/https://www.swascan.com/cactus-ransomware-malware-analysis/\n    - https://taiwan.postsen.com/business/88601/Hamas-hackers-use-data-destruction-software-BiBi-which-consumes-a-lot-of-processor-resources-to-wipe-Windows-computer-data--iThome.html\nauthor: Luc Génaux\ndate: 2023-11-28\ntags:\n    - attack.impact\n    - attack.defense-impairment\n    - attack.t1486\n    - attack.t1685\nlogsource:\n    category: image_load\n    product: windows\ndetection:\n    selection_img:\n        - ImageLoaded|endswith: '\\RstrtMgr.dll'\n        - OriginalFileName: 'RstrtMgr.dll'\n    selection_folders_1:\n        Image|contains:\n            # Note: increase coverage by adding more suspicious paths\n            - ':\\Perflogs\\'\n            - ':\\Users\\Public\\'\n            - '\\Temporary Internet'\n    selection_folders_2:\n        - Image|contains|all:\n              - ':\\Users\\'\n              - '\\Favorites\\'\n        - Image|contains|all:\n              - ':\\Users\\'\n              - '\\Favourites\\'\n        - Image|contains|all:\n              - ':\\Users\\'\n              - '\\Contacts\\'\n    condition: selection_img and 1 of selection_folders_*\nfalsepositives:\n    - Processes related to software installation\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1486","id":"T1486","name":"Data Encrypted for Impact","page":"techniques/enterprise/T1486/"},{"key":"enterprise/T1685","id":"T1685","name":"Disable or Modify Tools","page":"techniques/enterprise/T1685/"}],"data_path":"data/detection-rules/b48492dc-c5ef-4572-8dff-32bc241c15c8.json","kind":"sigma"}