SharkLoader Decoy PDF/MSI Drop with cmd.exe Lure Execution
Detects various indicators of SharkLoader activity, including the deployment of decoy MSI files, execution of suspicious masqueraded processes, use of double-extension files, and the creation of malicious DLL components in specific AppData subdirectories.
Microsoft Sentinel (KQL)
