Gamaredon Ptero-family obfuscated PowerShell writing registry Run key persistence
Detects persistence mechanisms associated with the Gamaredon Group (also known as Shuckworm/ACTINIUM) involving the Ptero-family of malware. The rule identifies suspicious combinations of encoded PowerShell commands (using -EncodedCommand, IEX, or FromBase64String), registry modification to Windows Run/RunOnce keys referencing suspicious interpreters (wscript, mshta, powershell, rundll32) within user profile paths, and command-line indicators of C2 activity such as DownloadString/WebClient or specific .ru/.online domain patterns.
YARA-L
