Mustang Panda SHARDLOADER Run Key and Scheduled Task Persistence

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•2

This rule detects persistence mechanisms associated with the SHARDLOADER threat activity, specifically monitoring for the creation of suspicious Registry 'Run' keys using the 'MediumNetMonIt' value or via scheduled task creation referencing known staging paths under 'C:\ProgramData\IDM\logs\'.