Detects .NET based stager using AppDomain Hijacking observed to be used by Nimbus Manticore (UNC1549). The stager drops

Hunt Hypothesis

This hunt hypothesis targets .NET-based staging processes that leverage AppDomain Hijacking to drop secondary payloads and establish persistence through scheduled tasks, a signature behavior of the Nimbus Manticore (UNC1549) threat actor. Proactively hunting for this specific chain in Azure Sentinel is critical because it identifies early-stage intrusion mechanisms that often evade traditional endpoint detection by masquerading as legitimate .NET application activity before executing malicious payloads.

YARA Rule

rule MAL_APT_Nimbus_Manticore_Stager_May26 {
   meta:
      description = "Detects .NET based stager using AppDomain Hijacking observed to be used by Nimbus Manticore (UNC1549). The stager drops another payload and establishes persistence via scheduled task."
      author = "Jonathan Peters (Nextron Systems)"
      date = "2026-05-20"
      reference = "https://www.nextron-systems.com/2026/06/01/detecting-nimbus-manticore-and-their-sideloading-infection-chains/"
      hash = "eee657ffdb2af8ed6412221e7d5fbf4f5742f2ac2c88f43f12db46af0697de71"
      score = 80
   strings:
      $x1 = "MyCompany-Product-TOTP-Salt-2024!@#$" wide fullword
      $x2 = "TOTPGuardRunner" ascii fullword
      $x3 = "\\AppDomainInjection-metlifeScenario\\TOTP" ascii

      $sa1 = "EncData" ascii fullword
      $sa2 = "DecryptAndSaveToDesktop" ascii fullword
      $sa3 = "CopyHelloToDesktop" ascii fullword

      $sb1 = "doit" wide fullword
      $sb2 = "DailyTrigger" wide fullword
      $sb3 = "GetTypeFromCLSID" ascii
      $sb4 = "yyyy-MM-ddTHH:mm:ss" wide fullword
   condition:
      uint16(0) == 0x5a4d
      and
      (
         1 of ($x*)
         or all of ($sa*)
         or all of ($sb*)
      )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 10 string patterns in its detection logic.

References

False Positive Guidance

Here are 3-5 specific false positive scenarios for the Nimbus Manticore AppDomain Hijacking Stager detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Legitimate .NET Deployment via Microsoft Endpoint Configuration Manager (SCCM/MECM)
- Scenario: During a scheduled software update or application deployment, SCCM utilizes .exe wrappers that load custom assemblies into the AppDomain of the CcmExec.exe process. This mimics the stager behavior by dropping new payload files to the %ProgramData% directory and creating a maintenance task via the Windows Task Scheduler (schtasks) to handle post-installation configuration or silent updates.
- Filter/Exclusion: Exclude processes where the parent image path matches C:\Windows\CCM\* (e.g., CcmExec.exe, WUAHandlerService.exe) and the dropped payload location is within known SCCM distribution points (C:\ProgramData\Microsoft\EndpointProtection or C:\Windows\CCM).
Office 365 ProPlus Click-to-Run Service Updates
- Scenario: The Office Click-to-Run service (OfficeClickToRun.exe) frequently performs background updates that involve .NET assembly loading. It often spawns temporary stager processes to download and stage new update manifests, subsequently registering a scheduled task (e.g., Microsoft Office ClickToRun Service) to manage future update cycles or license validation, triggering the AppDomain hijacking signature.
- Filter/Exclusion: Create an exclusion for parent process names containing OfficeClickToRun.exe and filter out events where the dropped payload file extension is .msi, .cab, or located within C:\Program Files\Microsoft Office Root.
**Enterprise Antivirus Heuristic Scanning (e.g., CrowdStrike Falcon or Sentinel