GammaSteel DPAPI Registry Encryption via PowerShell

Ethan Andrews@eandrews

•updated Jun 4, 2026•1•0•7

Detects PowerShell script logic associated with GammaSteel's fileless registry staging encryption, specifically the use of ConvertTo-SecureString alongside the HKCU:\Printers path. This technique is used by Gamaredon to bind payload encryption to the active user session and hinder forensic analysis.