huntrule

Suspicious Shahmaran Autostart Masquerading as Adobe Updater

PremiumReviewedSigma · Medium · v1
Product
windows
Category
registry_set
Author
HuntRule
Published
2026-09-24
Updated
2026-09-24
AnalysisDetection

ATT&CK techniques

Persistence → Priv Esc

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects registration of an autostart Run key value pointing to adobeupdater.exe, a persistence file name used by the BladedFeline group to launch the Shahmaran backdoor while impersonating Adobe update software. The legitimate-looking name combined with autorun persistence indicates a masqueraded implant rather than genuine Adobe tooling.

Reporting behind it

Related detections9 linkedT1547.001 — drag to rearrange
Suspicious K7Soft Autostart Persistence
Suspicious Run Key Persistence to svcghost in Public WPSManager Path via Registry
Malicious Startup LNK Dropped by WinRAR via CVE-2025-8088 Path Traversal
Suspicious Run Key Persistence Masquerading as MicrosoftUpdate via Axios npm Compromise
Suspicious Startup Persistence via Registry Run Key Pointing to Script
Suspicious User Shell Folders Startup Redirect for Persistence via Registry
Malicious XRed Backdoor Execution from ProgramData Synaptics Path (via process_creation)
Suspicious Double Extension Executable Execution via Command Line
Suspicious SCMBanker Autostart Persistence via Run Key VBScript
Suspicious Shahmaran Autostart Masquerading as Adobe Updater
Pivot detection · T1547.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.