Mustang Panda SHARDLOADER/ZOHOMURK Persistence via Run Key or Scheduled Task

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

This rule detects potential persistence mechanisms by monitoring for the creation of specific, suspicious scheduled tasks or the modification of registry values. The patterns flagged include known indicators of malicious activity such as specific directory paths (e.g., \ProgramData\IDM\logs\ or \Microsoft\VaultCache\) and known malicious file names associated with unauthorized background execution.