AppDomainManager Hijack Assembly Delivered

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects the delivery of a file over HTTP that contains the strings "AppDomainManager" and "CreateDomain" (case-insensitive). This combination of strings is indicative of an attempt to hijack the AppDomainManager, a technique used for persistence in .NET applications, often associated with T1574.014 (AppDomainManager Hijacking) from MITRE ATT&CK.