Gamaredon Ptero-family PowerShell implant execution with encoded commands and registry persistence

Ibrahim Saud@tektrix

•updated Jun 26, 2026•1•0•2

Detects execution of PowerShell commands associated with the Gamaredon Group's Ptero malware family. This rule monitors for suspicious PowerShell command lines (including encoded commands and common obfuscation patterns) originating from Office applications or temporary directories, correlated with network connections to known Gamaredon C2 domains or registry modifications to Run keys for persistence.