Rule Info
Name
Modification of AppDomain Manager Environment Variables
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Description
Detects modification of AppDomain Manager environment variables in the registry,
which can be abused to hijack .NET AppDomain Manager.
Adversaries can set these variables to point to a malicious assembly, causing any legitimate
.NET applications to load it upon startup, enabling stealthy code execution.
Date
2026-07-20 00:00:00
Modified
None
Id
fccc691c-fc29-4c91-b330-0564f306fb1b
Tags
attack.stealth attack.execution attack.t1574.014
Type
Nextron Sigma feed only (private)
Rule History
Scan your endpoints, forensic images or collected files with our portable scanner THOR