Gamaredon PteroEffigy loader spawning Kazuar scheduled task persistence
Detects the multi-stage execution chain associated with the Gamaredon group's PteroEffigy loader. The rule monitors for PowerShell or scriptrunner instances originating from suspicious directories (AppData/Temp) that employ .NET reflection to load DLLs into memory. It then detects the subsequent creation of a scheduled task with a random alphanumeric name and the eventual execution of regsvr32 or rundll32 by that task to load the malicious DLL. Additionally, the rule identifies potential command-and-control activity by detecting specific Kazuar malware HTTP User-Agent strings.
YARA-L
