SharkLoader Loader-Lock Bypass: Suspended Thread Resume for Cobalt Strike

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•0

Detects suspicious execution patterns involving SystemSettings.exe, specifically when spawned by uncommon binaries (xwreg.exe or xgdf.exe) or when performing thread creation operations, which may indicate process injection or suspicious lateral movement attempts.