TinyRCT Loader Downloads-Path Anti-Sandbox Check via MyAppDomainManager.dll

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•2

This rule detects suspicious activity associated with the TinyRCT malware, specifically identifying the loading of 'MyAppDomainManager.dll' in unexpected process paths or in conjunction with 'chrome_setup.exe'. It also monitors for 'PerfWatson2.exe' instances executing outside of the expected local application data directory, which is a known indicator of this campaign's persistence and execution behavior.