AppDomainManager Hijacking via Unexpected .exe.config Write (T1574.014)
Detects the creation of .exe.config files by potentially unauthorized or suspicious processes. Attackers may use these configuration files to hijack the .NET AppDomainManager, enabling malicious code execution when the associated executable is launched. The rule monitors file creation events (Sysmon Event ID 11) and filters out expected installers or update processes while flagging suspicious writing processes like PowerShell, CMD, or non-standard binaries.
Splunk (SPL)
