Steganographic Loader TuglaInsaatci Run Key Persistence via Hidden PowerShell Script

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•1

Detects the TuglaInsaatci steganographic loader establishing persistence via a Windows Run registry key. The rule identifies suspicious PowerShell commands (execution policy bypass, hidden window, hidden file path) pointing to a script located within the AppData\Local\Temp directory, a technique associated with the FortiBleed campaign to deliver the Remcos RAT.