Ransomware process loads RstrtMgr.dll to unlock files via Restart Manager APIs
Detects the 'beast.exe' process loading the 'RstrtMgr.dll' library. This behavior may be indicative of DLL side-loading, hijacking, or the execution of potentially malicious code masquerading as or interacting with system libraries.
Microsoft Sentinel (KQL)
