Nimbus Manticore - AppDomainManager Configuration Drop (T1574.014)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•3

Identifies the creation of a .config file matching a newly relocated executable's name, used to force the .NET runtime to load the TOTPGuard.dll AppDomainManager. This rule specifically looks for the simultaneous creation of an executable (.exe) and a corresponding configuration file (.exe.config) in the same directory, which is a known technique used by the Nimbus Manticore threat actor for AppDomainManager hijacking.