SharkLoader/Cobalt Strike Registry Run Key Persistence via reg.exe to Temp or AppData
Detects modification or creation of registry run keys in HKLM or HKCU hives that point to suspicious paths (AppData, Temp, ProgramData, or specific SharkLoader directories) or filenames (SystemSettings.exe). This behavior is indicative of malware attempting to establish persistence.
Microsoft Sentinel (KQL)
