SharkLoader Registry Run Key and Scheduled Task Persistence via SystemSettings.exe

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

Detects the modification of Windows registry run keys (HKCU or HKLM) by SystemSettings.exe or msiexec.exe. This activity is often associated with persistence mechanisms where an adversary attempts to maintain execution across system reboots by registering malicious code in startup locations.