StrikeShark Registry Run Key Persistence via Suspicious Executable Paths

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•2

Detects registry run key and logon persistence modifications commonly used by the StrikeShark campaign. This rule monitors for entries in standard Windows autorun registry keys and Winlogon persistence locations where the associated file path is located in user-writable directories (AppData, Temp, Public) or contains suspicious file extension patterns, which are indicative of malware such as Sharkloader.