AppDomain Hijacking Config Modification

wakasa smoky@wakasadb3

•updated Mar 20, 2026•2•1•101

Detects the creation or modification of .NET application configuration files (`.exe.config`) in sensitive framework directories. This is a technique known as AppDomain Hijacking, used by the Silver Dragon APT group to hijack legitimate Windows services like `dfsvc.exe` and `tzsync.exe` for persistence and to load their malware (MonikerLoader).