SharkLoader DscCoreR.mui Multi-Stage Encrypted Payload Decryption Chain
This rule detects processes accessing or loading specific files (such as .mui, .dat, .nls, and .etl files) that are associated with specific naming conventions (xwreg, xgdf) or locations often targeted by malicious DLL search order hijacking or masquerading attempts. By identifying files that mimic or occupy paths related to system resources, the rule aims to uncover activity indicative of persistence or evasion techniques.
CQL
