processes related to software installation

Techniques

Sample rules

Load Of RstrtMgr.DLL By A Suspicious Process

source: sigma
technicques:
- t1486
- t1562
- t1562.001

Description

Detects the load of RstrtMgr DLL (Restart Manager) by a suspicious process. This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows. It could also be used for anti-analysis purposes by shut downing specific processes.

Detection logic

condition: selection_img and 1 of selection_folders_*
selection_folders_1:
  Image|contains:
  - :\Perflogs\
  - :\Users\Public\
  - \Temporary Internet
selection_folders_2:
- Image|contains|all:
  - :\Users\
  - \Favorites\
- Image|contains|all:
  - :\Users\
  - \Favourites\
- Image|contains|all:
  - :\Users\
  - \Contacts\
selection_img:
- ImageLoaded|endswith: \RstrtMgr.dll
- OriginalFileName: RstrtMgr.dll

Load Of RstrtMgr.DLL By An Uncommon Process

source: sigma
technicques:
- t1486
- t1562
- t1562.001

Description

Detects the load of RstrtMgr DLL (Restart Manager) by an uncommon process. This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows. It could also be used for anti-analysis purposes by shut downing specific processes.

Detection logic

condition: selection and not 1 of filter_main_*
filter_main_admin_software_installations:
  Image|contains: :\Windows\Temp\
filter_main_generic:
  Image|contains:
  - :\$WINDOWS.~BT\
  - :\$WinREAgent\
  - :\Program Files (x86)\
  - :\Program Files\
  - :\ProgramData\
  - :\Windows\explorer.exe
  - :\Windows\SoftwareDistribution\
  - :\Windows\SysNative\
  - :\Windows\System32\
  - :\Windows\SysWOW64\
  - :\Windows\WinSxS\
  - :\WUDownloadCache\
filter_main_user_software_installations:
  Image|contains|all:
  - :\Users\
  - \AppData\Local\Temp\is-
  - .tmp\
  Image|endswith: .tmp
selection:
- ImageLoaded|endswith: \RstrtMgr.dll
- OriginalFileName: RstrtMgr.dll