StrikeShark Masquerading: SystemSettings.exe or FScan Renamed Binary PE Mismatch

Ibrahim Saud@tektrix

•updated Jun 28, 2026•1•0•1

Detects the execution of suspected StrikeShark-related binaries (SystemSettings.exe and FScan) when they are found running from non-standard directories or masquerading as legitimate system processes. The rule specifically monitors for instances where these binaries are executed from user-writable paths like AppData or Temp, while excluding legitimate Windows paths and processes associated with Windows Update.