StrikeShark PPID Spoofing: Cobalt Strike Spawn via SharkLoader SystemSettings.exe

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

Detects instances where SystemSettings.exe is spawned from non-standard directories often associated with the SharkLoader malware family, such as AppData roaming subdirectories or KasperskyLab program folders. This behavior is indicative of masquerading and malicious staging.