Gamaredon Dead-Drop Resolver: Script Interpreters Contacting Known C2 Retrieval Domains

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•6

This rule detects network connections initiated by common Windows script interpreters (PowerShell, WScript, CScript, MSHTA) to known public paste or text sharing services. Adversaries often use these sites to host malicious payloads, C2 configurations, or to exfiltrate data, bypassing traditional network blocks by using reputable services. The rule excludes processes signed by Microsoft to reduce noise.