Shadowcampaigns Shadowguard Jar

Daniel Jeremiah@daniyyell

•updated Feb 23, 2026•1•0•42

Detects Windows PE files that contain string indicators associated with the Diaoyu loader as reported in the Shadow Campaigns research. The rule keys on multiple distinctive strings, including references to WordPress themed artefacts, a GitHub raw content host, and Diaoyu specific markers, and requires an MZ header plus either two or more indicators or specific high confidence string pairs.