Gamaredon Kazuar Second-Stage Deployment via PowerShell Loader on Same Host

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•1

This rule detects a multi-stage execution pattern where a PowerShell process (PteroLoader) executes with suspicious flags (encoded or hidden commands) and subsequently launches a child process that is not part of a common list of legitimate system processes. This behavior is indicative of potential malware staging or command-and-control activity, specifically targeting unauthorized child process creation following PowerShell obfuscation.