Gamaredon GammaSteel Registry Persistence via PowerShell

Ethan Andrews@eandrews

•updated Jun 4, 2026•1•0•6

Detects PowerShell executions associated with Gamaredon's GammaSteel persistence mechanism, which reconstructs a payload path from the HKCU:\Printers registry key and executes it using [scriptblock]::Create. This technique indicates an attempt to maintain access by leveraging registry keys for autostart execution and dynamic script execution.