SharkLoader Loader Lock Bypass Self-Injection from AppData xwreg/xgdf

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•5

Detects techniques associated with the SharkLoader malware (StrikeShark campaign) that bypass loader locks via self-injection. It monitors Sysmon Event ID 8 (CreateRemoteThread) for suspicious self-injection from specific staging directories (\xwreg\ or \xgdf\) and Sysmon Event ID 10 (ProcessAccess) for instances where these binaries open themselves with full access rights to manipulate the loader lock prior to Cobalt Strike delivery.