Restart Manager API abuse to force-close file lock holders before encryption

Ibrahim Saud@tektrix

•updated Sep 18, 2026•1•0•4

This rule detects processes that load the 'rstrtmgr.dll' library and subsequently perform mass process termination (3 or more distinct processes in under 2 minutes, excluding 'explorer.exe'). This behavior is commonly associated with ransomware, such as DragonForce, which uses the Windows Restart Manager API to identify and forcefully close applications that are locking files they intend to encrypt.