BeardShell Execution Guardrail

Elgonad .@elgonad

•updated Mar 16, 2026•0•40

Detects suspicious modules loaded by taskhost.exe or taskhostw.exe, which is a known execution guardrail for the BeardShell implant used by Sednit (APT28).