StrikeShark SharkLoader DLL Sideload via SystemSettings.exe in AppData
Detects the loading of suspicious DLLs and support files (e.g., systemsettings.dll, dsccorer.mui, syncres.dat, msedge.dll) from atypical AppData subdirectories ('xwreg' or 'xgdf'). The rule correlates these file loads with known MD5 hashes associated with Sharkloader, indicating potential malicious payload execution or side-loading activities.
Splunk (SPL)
