SharkLoader MinHook DLL VirtualAlloc and Sleep API Hooking via SyncRes.dat
The detection monitors for the loading of specific files ('SyncRes.dat' or 'DscCoreR.mui') that are known to be used as side-loading targets for malicious DLLs. These file names are frequently associated with various malware campaigns leveraging DLL search order hijacking to execute malicious code within the context of trusted applications.
Cortex XDR
