GammaSteel DPAPI Registry Encryption

Duo Tech@duotech

•updated Jun 4, 2026•1•0•11

Detects PowerShell script logic associated with GammaSteel's fileless registry staging encryption, specifically the use of the DPAPI cmdlet ConvertTo-SecureString alongside the HKCU:\Printers path. This technique binds the encryption to the active user session to hinder forensic analysis.