Gamaredon Ptero-family PowerShell downloader spawned from Office or explorer

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•2

Detects instances where common productivity applications (such as Microsoft Office suite, Outlook, or script engines like mshta/wscript) spawn PowerShell or PowerShell Core. The rule specifically looks for suspicious command line arguments often associated with malicious payloads, such as encoded commands, download instructions, or specific indicators related to Ptero-family malware.