StrikeShark SharkLoader Scheduled Task Persistence via OneDrive Task Name
Detects the creation of suspicious scheduled tasks used by the StrikeShark campaign for persistence. These tasks are named with a prefix mimicking OneDrive updates ('OneDrive Standalone Update Task-S-1-') and are configured to execute SystemSettings.exe from specific AppData subdirectories ('xwreg' or 'xgdf'). The rule correlates process execution logs and scheduled task creation events to identify the dropper activity.
Microsoft Sentinel (KQL)
