StrikeShark SharkLoader Scheduled Task Persistence via SystemSettings.exe

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•2

This rule detects the creation of scheduled tasks using schtasks.exe that exhibit characteristics associated with the SharkLoader malware. Specifically, it identifies tasks using suspicious names like 'OneDrive Standalone Update Task' or those referencing components dropped in %APPDATA% directories (e.g., \xwreg\, \xgdf\), or tasks masquerading as 'SystemSettings.exe' or 'KasperskyLab' directories.