Gamaredon Office Child Process PowerShell/cmd Execution - Ptero Toolset
Detects execution chains attributed to the Gamaredon threat group (also known as Shuckworm/ACTINIUM). The rule monitors Microsoft Office applications (Word, Excel, PowerPoint, Equation Editor) spawning cmd.exe or powershell.exe, where the child process contains suspicious patterns such as base64 blobs, script download commands, or known Gamaredon Ptero-toolset strings (PteroPaste, PteroVDoor, PteroDee). This activity is correlated with a network connection to non-Microsoft infrastructure within 60 seconds of process execution.
YARA-L
