StrikeShark SharkLoader Registry Run Key Persistence via xwreg or xgdf AppData Paths
This rule detects modifications to Windows Registry Run keys that point to suspicious directories associated with the SharkLoader malware (such as 'xwreg' or 'xgdf' subdirectories in AppData) or an abnormally located SystemSettings.exe executable, both of which are common indicators of persistence attempts.
Splunk (SPL)
