Suspicious Sideloading File Staging (Nimbus Manticore)

Ethan Andrews@eandrews

•updated Jun 2, 2026•4•0•15

This rule detects the creation of specific files associated with AppDomain hijacking by the Nimbus Manticore threat actor. It looks for the creation of files like 'setup.exe.config', 'TOTPGuard.dll', 'main.dll', and 'setup.exe' within the '\AppData\Roaming\2FAGuard\' directory. The rule is tuned to trigger when at least two distinct campaign files are created within a 10-minute window on the same device.