Gamaredon PteroOdd/PteroSand USB Lateral Movement - Scripting Engine from Removable Drive

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•1

Detects execution of common script interpreters (wscript.exe, cscript.exe, powershell.exe, mshta.exe) where the command line argument references a file residing on a drive letter path (e.g., C:\, D:\). This pattern is often used in the execution of downloaded payloads or local malicious scripts.