SharkLoader DLL Sideload via SystemSettings.exe outside legitimate path
This rule detects the execution of SharkLoader components, specifically identifying unauthorized SystemSettings.exe processes attempting to load malicious DLLs (e.g., SystemSettings.dll, DscCoreR.mui, SyncRes.dat) from locations outside of the legitimate C:\Windows\ImmersiveControlPanel\ directory. It also tracks the creation or modification of these payload files in common persistence directories like AppData or ProgramData.
SentinelOne
