SharkLoader DLL Sideloading via xwreg/xgdf APPDATA Directories

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

Detects the deployment of SharkLoader components into suspicious directories (%APPDATA%\xwreg, %APPDATA%\xgdf, or %ProgramData%\KasperskyLab) followed by the execution of SystemSettings.exe from these locations. This rule also tracks the loading of encrypted DLL payloads like DscCoreR.mui or SyncRes.dat by these processes, which is indicative of a DLL sideloading execution chain.