Gamaredon NTFS ADS and Hidden File Attribute Staging - PteroCache/PteroOdd
Detects Gamaredon Group activity involving the staging of malicious payloads using NTFS Alternate Data Streams (ADS) and hidden file attributes (PteroCache/PteroOdd). The rule monitors for three primary staging behaviors: the creation of ADS files via script interpreters (Office, wscript, PowerShell), the modification of file attributes to hidden or system (+H/+S) in sensitive paths, and the enumeration of ADS streams using 'dir /R'. These staging actions are correlated with subsequent process execution from user-writable directories (e.g., APPDATA, TEMP) within a 5-minute window to identify the full infection chain.
YARA-L
