SharkLoader Loader-Lock Release and Malicious Thread Spawn via SystemSettings.exe
Detects anomalous activity associated with the SharkLoader malware, which masquerades as the legitimate Windows SystemSettings.exe process. The rule identifies suspicious characteristics such as execution from non-standard directories (AppData), use of MinHook for API hooking, loading of known payload-related files (syncres.dat, dsccorer.mui), and unauthorized remote thread creation.
Splunk (SPL)
