AppDomainManager Injection Loading MyAppDomainManager.dll or PerfWatson2.exe

Ibrahim Saud@tektrix

•updated Jun 27, 2026•2•0•1

This rule monitors for suspicious process execution and module loading events, specifically targeting file paths and configurations associated with potential AppDomain Manager injection or masquerading techniques (e.g., PerfWatson2.exe, VMware tools, or Chrome setup configurations). It correlates Sysmon and Security event logs to detect known malicious patterns or abnormal file behaviors.