Mustang Panda SHARDLOADER/MINIRECON DLL Sideloading via Solid PDF Creator or Citrix Receiver

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

This rule detects potential DLL side-loading and file staging activity by monitoring for the execution of specific suspicious binaries or the loading of known malicious DLLs from non-standard or staging directories like C:\Users\Public\Documents\ or C:\ProgramData\IDM\logs\. The rule flags activity associated with loaders like SHARDLOADER, ZOHOMURK, and MINIRECON.