Mustang Panda SHARDLOADER MediumNetMonIt Run Key Persistence

Ibrahim Saud@tektrix

•updated Jun 30, 2026•7•0•7

This rule monitors for the creation or modification of specific Windows Registry run keys. These keys are commonly used by malware and adversaries to achieve persistence, ensuring malicious code executes automatically upon system login. The rule specifically alerts on suspicious value names or paths associated with known threats or obfuscated file paths residing in common persistence directories.