Havoc Loader DLL Sideload via ADNotificationManager
This rule detects the execution of 'ADNotificationManager.exe' from a specific path within 'ProgramData\Adobe\ARM\'. This activity is associated with a support-scam malware chain, specifically Havoc Loader, which stages itself in a folder designed to mimic legitimate Adobe directories. The rule focuses on this unusual path and exact helper name to identify the transition from social engineering to malicious execution, aiming to provide a strong lead for review by flagging suspicious activity in a trusted-looking directory.
Sigma
