SharkLoader Decoy PDF/MSI Dropper Execution via cmd.exe or Masqueraded Installer

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•0

This rule monitors for potentially malicious process activity characterized by either cmd.exe executing commands with PDF-related arguments, or specific executables often associated with installers or update mechanisms (GoogleUpdateStepup, AutoUpdate, AnyConnect-win) being executed or spawning processes. This behavior is indicative of potential application masquerading, software installer abuse, or malicious document execution.