SHARDLOADER/Gentlemen Backdoor Persistence via Scheduled Task or Run Key
Detects persistence mechanisms associated with the SHARDLOADER malware family, including the creation of suspicious scheduled tasks and modification of registry run keys. The rule monitors processes, scheduled task events, and registry value changes for specific indicators such as paths in C:\ProgramData\IDM\logs\, files named 'pcl2bmp' or 'mediuminststart', and DLL sideloading patterns involving SolidPDFCreator.
Splunk (SPL)
