Mustang Panda SHARDLOADER DLL Sideloading via Solid PDF Creator Executables
This rule detects potential DLL sideloading activity associated with the SHARDLOADER implant, commonly linked to the threat actor Mustang Panda. It monitors for suspicious executable names (e.g., Project Proposal.exe) loading malicious DLLs (SolidPDFCreator.dll, ctxmui.dll) or interacting with specific staging directories in ProgramData or User Public folders, typical of their TTPs targeting government and energy sectors.
Microsoft Sentinel (KQL)
