Gamaredon GammaLoad Scheduled Task ADS Execution

Duo Tech@duotech

•updated Jun 4, 2026•1•0•10

Detects the execution of an Alternate Data Stream (ADS) payload located in the %TEMP% directory via wscript.exe, a critical persistence mechanism used by Gamaredon's GammaLoad.