SharkLoader Decoy PDF Lure Spawned via cmd.exe from Dropper in %TEMP%\aswerf
Detects the execution of cmd.exe spawned by processes running from suspicious directory paths such as %TEMP%\aswerf\, %APPDATA%\xwreg\, or %APPDATA%\xgdf\. These paths are commonly associated with dropper activity or malicious payloads. The rule specifically monitors for command lines containing '.pdf', suggesting the potential opening of a lure document.
Cortex XDR
