Load Of RstrtMgr.DLL By An Uncommon Process

Hunt Hypothesis

An adversary may use an uncommon process to load RstrtMgr.DLL in an attempt to terminate processes that interfere with ransomware operations, such as file encryption. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify potential ransomware activity early and mitigate its impact.

Detection Rule

Sigma (Original)

title: Load Of RstrtMgr.DLL By An Uncommon Process
id: 3669afd2-9891-4534-a626-e5cf03810a61
related:
    - id: b48492dc-c5ef-4572-8dff-32bc241c15c8
      type: derived
status: test
description: |
    Detects the load of RstrtMgr DLL (Restart Manager) by an uncommon process.
    This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows.
    It could also be used for anti-analysis purposes by shut downing specific processes.
references:
    - https://www.crowdstrike.com/blog/windows-restart-manager-part-1/
    - https://www.crowdstrike.com/blog/windows-restart-manager-part-2/
    - https://web.archive.org/web/20231221193106/https://www.swascan.com/cactus-ransomware-malware-analysis/
    - https://taiwan.postsen.com/business/88601/Hamas-hackers-use-data-destruction-software-BiBi-which-consumes-a-lot-of-processor-resources-to-wipe-Windows-computer-data--iThome.html
author: Luc Génaux
date: 2023-11-28
modified: 2025-12-08
tags:
    - attack.impact
    - attack.defense-evasion
    - attack.t1486
    - attack.t1562.001
logsource:
    category: image_load
    product: windows
detection:
    selection:
        - ImageLoaded|endswith: '\RstrtMgr.dll'
        - OriginalFileName: 'RstrtMgr.dll'
    filter_main_generic:
        Image|startswith:
            - C:\$WINDOWS.~BT\'
            - C:\$WinREAgent\'
            - C:\Program Files (x86)\'
            - C:\Program Files\'
            - C:\ProgramData\'
            - C:\Windows\explorer.exe'
            - C:\Windows\SoftwareDistribution\'
            - C:\Windows\SysNative\'
            - C:\Windows\System32\'
            - C:\Windows\SysWOW64\'
            - C:\Windows\WinSxS\'
            - C:\WUDownloadCache\'
    filter_main_user_software_installations:
        Image|startswith: C:\Users\'
        Image|contains|all:
            - '\AppData\Local\Temp\is-'
            - '.tmp\'
        Image|endswith: '.tmp'
    filter_main_admin_software_installations:
        Image|startswith: C:\Windows\Temp\'
    filter_optional_onedrive:
        Image|startswith: 'C:\Users\'
        Image|endswith: '\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Other legitimate Windows processes not currently listed
    - Processes related to software installation
level: low

KQL (Microsoft 365 Defender)

DeviceImageLoadEvents
| where (FolderPath endswith "\\RstrtMgr.dll" or InitiatingProcessVersionInfoOriginalFileName =~ "RstrtMgr.dll") and (not(((InitiatingProcessFolderPath startswith "C:\\$WINDOWS.~BT\\'" or InitiatingProcessFolderPath startswith "C:\\$WinREAgent\\'" or InitiatingProcessFolderPath startswith "C:\\Program Files (x86)\\'" or InitiatingProcessFolderPath startswith "C:\\Program Files\\'" or InitiatingProcessFolderPath startswith "C:\\ProgramData\\'" or InitiatingProcessFolderPath startswith "C:\\Windows\\explorer.exe'" or InitiatingProcessFolderPath startswith "C:\\Windows\\SoftwareDistribution\\'" or InitiatingProcessFolderPath startswith "C:\\Windows\\SysNative\\'" or InitiatingProcessFolderPath startswith "C:\\Windows\\System32\\'" or InitiatingProcessFolderPath startswith "C:\\Windows\\SysWOW64\\'" or InitiatingProcessFolderPath startswith "C:\\Windows\\WinSxS\\'" or InitiatingProcessFolderPath startswith "C:\\WUDownloadCache\\'") or (InitiatingProcessFolderPath startswith "C:\\Users\\'" and (InitiatingProcessFolderPath contains "\\AppData\\Local\\Temp\\is-" and InitiatingProcessFolderPath contains ".tmp\\") and InitiatingProcessFolderPath endswith ".tmp") or InitiatingProcessFolderPath startswith "C:\\Windows\\Temp\\'"))) and (not((InitiatingProcessFolderPath startswith "C:\\Users\\" and InitiatingProcessFolderPath endswith "\\AppData\\Local\\Microsoft\\OneDrive\\OneDriveStandaloneUpdater.exe")))

False Positive Guidance

• Scenario: Scheduled Task Running System Maintenance Tool
  Description: A legitimate scheduled task runs System Maintenance Tool (e.g., schtasks.exe or Task Scheduler) which loads RstrtMgr.DLL as part of its normal operation.
  Filter/Exclusion: Exclude processes associated with Task Scheduler or schtasks.exe, or filter by process names like schtasks.exe, TaskSchd.exe, or msdtc.exe.

• Scenario: Windows Update or System File Checker (SFC) Scan
  Description: During a Windows Update or System File Checker (SFC) scan, the system may load RstrtMgr.DLL to manage process restarts during file system checks.
  Filter/Exclusion: Exclude processes related to Windows Update (e.g., wuauserv.exe, svchost.exe with wuauserv service) or sfc.exe.

• Scenario: Microsoft Endpoint Configuration Manager (MECM) Deployment
  Description: A deployment via Microsoft Endpoint Configuration Manager (formerly SCCM) may load RstrtMgr.DLL when restarting services or applications during a software update.
  Filter/Exclusion: Exclude processes associated with CCMExec.exe, CCMSetup.exe, or SMS Executive services.

• Scenario: Microsoft SQL Server Maintenance Job
  Description: A SQL Server maintenance job (e.g., index rebuild or database integrity check) may trigger the loading of RstrtMgr.DLL if it requires restarting services or processes.
  Filter/Exclusion: Exclude processes related to sqlservr.exe, sqlagent.exe, or any SQL Server service account processes.

• Scenario: Windows Defender Antivirus Scan
  Description: During a full system scan by Windows Defender, the system may load

MITRE ATT&CK Context

• Tactic: Impact
• Tactic: Defense Evasion
• Technique: T1486
• Technique: T1562.001