StrikeShark SharkLoader Masquerading as GoogleUpdate or AnyConnect with Decoy PDF

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

This rule monitors process creation events (Sysmon Event ID 1) to identify suspicious executables that masquerade as common software updaters (GoogleUpdateStepup, AnyConnect, AutoUpdate) or attempt to run the Windows SystemSettings.exe binary from non-standard directories. It further flags these instances when they are launched with specific command-line indicators such as cmd.exe or PDF file paths, which are common patterns for droppers or malicious execution chains.