SHARDLOADER shellcode execution via EnumSystemLocalesA callback abuse
Detects the use of the 'EnumSystemLocalesA' API call where the provided callback address points to a non-image backed memory region with 'EXECUTE' permissions. This pattern is indicative of process injection techniques, where an adversary uses an API callback mechanism to execute malicious code within the memory space of a legitimate process.
Microsoft Sentinel (KQL)
