SharkLoader DscCoreR.mui Encrypted Payload Staged Outside Windows System Directories

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•3

Detects SharkLoader malware staging its encrypted PE payload, 'DscCoreR.mui', to directories outside legitimate Windows MUI locations. The rule monitors both file creation and module loading events, excluding known legitimate Windows servicing processes while accounting for MSI installer activities.