Hayabusa low test sigma

Load Of RstrtMgr.DLL By An Uncommon Process

Detects the load of RstrtMgr DLL (Restart Manager) by an uncommon process. This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows. It could also be used for anti-analysis purposes by shut downing specific processes.

View Source

Detection Logic

{
  "image_load": {
    "EventID": 7,
    "Channel": "Microsoft-Windows-Sysmon/Operational"
  },
  "selection": [
    {
      "ImageLoaded
| endswith": "\\RstrtMgr.dll"
    },
    {
      "OriginalFileName": "RstrtMgr.dll"
    }
  ],
  "filter_main_generic": {
    "Image
| startswith": [
      "C:\\$WINDOWS.~BT\\",
      "C:\\$WinREAgent\\",
      "C:\\Program Files (x86)\\",
      "C:\\Program Files\\",
      "C:\\ProgramData\\",
      "C:\\Windows\\explorer.exe",
      "C:\\Windows\\SoftwareDistribution\\",
      "C:\\Windows\\SysNative\\",
      "C:\\Windows\\System32\\",
      "C:\\Windows\\SysWOW64\\",
      "C:\\Windows\\WinSxS\\",
      "C:\\WUDownloadCache\\"
    ]
  },
  "filter_main_user_software_installations": {
    "Image
| startswith": "C:\\Users\\",
    "Image
| contains
| all": [
      "\\AppData\\Local\\Temp\\is-",
      ".tmp\\"
    ],
    "Image
| endswith": ".tmp"
  },
  "filter_main_admin_software_installations": {
    "Image
| startswith": "C:\\Windows\\Temp\\"
  },
  "filter_optional_onedrive_1": {
    "Image
| startswith": "C:\\Users\\",
    "Image
| endswith": [
      "\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe",
      "\\AppData\\Local\\Microsoft\\OneDrive\\OneDriveStandaloneUpdater.exe"
    ]
  },
  "filter_optional_onedrive_2": {
    "Image
| startswith": "C:\\Users\\",
    "Image
| contains": "\\AppData\\Local\\Microsoft\\OneDrive\\",
    "Image
| endswith": "\\OneDrive.Sync.Service.exe"
  },
  "condition": "image_load and (selection and not 1 of filter_main_* and not 1 of filter_optional_*)"
}

False Positives

  • ⚠ Other legitimate Windows processes not currently listed
  • ⚠ Processes related to software installation

Field Validations

Loading…

Comments (0)

Loading comments...