Gamaredon PteroVDoor/PteroPSDoor Exfil to Wasabi/i3storage S3
Detects network activity associated with Gamaredon threat group backdoors (PteroVDoor and PteroPSDoor) exfiltrating data to S3-compatible cloud storage providers. The rule identifies suspicious outbound network requests to specific domains ('wasabisys.com', 'i3storage.com') originating from processes that are not common browsers or trusted software, or by command-line execution of PowerShell, curl, or wget.
SentinelOne
