CL-STA-1062 AppDomainManager Injection via chrome_setup.exe Loading MyAppDomainManager.dll

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•2

This rule detects indicators of compromise associated with the TinyRCT malware, including the loading of a malicious AppDomainManager DLL by chrome_setup.exe, network connections to a known TinyRCT staging server, and the dropping of second-stage payloads such as PerfWatson2.exe to the local application data directory.