All Detections

Gamaredon NTFS ADS Script Execution

avatar
Ibrahim Saud@tektrix
updated Jun 21, 2026005

Detection of VBScript/HTA components executing from NTFS Alternate Data Streams (e.g., :GTR or :URL) used by GammaWorm.

YARA-L