Gamaredon PteroCache/PteroDum/PteroPSDoor Cloud Storage Exfiltration

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•2

This rule detects the execution of common scripting interpreters (PowerShell, WScript, CScript) that include command-line arguments referencing major cloud storage providers and file-hosting services. This behavior is frequently associated with data exfiltration or the staging of malicious payloads using legitimate web services.