StrikeShark SharkLoader DLL Sideloading via SystemSettings.exe
Detects the execution of SystemSettings.exe from non-standard locations such as %APPDATA% or %PROGRAMDATA%. This behavior is consistent with the SharkLoader malware (observed in the StrikeShark campaign), which uses DLL side-loading of a malicious SystemSettings.dll to facilitate persistence and payload delivery, eventually executing Cobalt Strike.
Microsoft Sentinel (KQL)
