SharkLoader Perfect DLL Hijacking: LdrpLoaderLock Resolve and Malicious Thread Spawn

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

Detects behavior patterns associated with the SharkLoader malware, specifically monitoring for anomalous thread creation, potential modification of primary tokens, and suspicious loading of SystemSettings.dll from non-standard directories (e.g., AppData, ProgramData). This rule aims to identify evasive techniques used to bypass Windows Loader Lock detection.