SharkLoader Dropper Writing Components to AppData xwreg or xgdf Directories
This rule detects the creation of executable files within specific directories in the user's AppData Roaming profile, specifically matching patterns associated with known persistence or malicious staging filenames (xwreg or xgdf). This location is frequently abused by attackers to store persistent payloads that execute outside of standard program directories.
CQL
