Possible AppDomainManager Hijacking via Dfsvc Process
This rule looks for a common hijacking method involving modification of the AppDomainManager in .NET applications. The 'dfsvc.exe' process can be relocated or renamed, and when paired with a crafted config file, may execute malicious code from DomainManager.dll before the application loads.
Sigma
