Mustang Panda SHARDLOADER Named Event Mutex uydgcfteionxcfd

Ibrahim Saud@tektrix

•updated Jun 30, 2026•6•0•4

This rule detects activity associated with the SHARDLOADER malware loader. It monitors for the presence of specific DLL files ('SolidPDFCreator.dll' or 'MediumInstStart.exe') in process image paths or process names, and explicitly checks for the creation of a unique mutex artifact named 'uydgcfteionxcfd' as a high-confidence indicator of execution.