Gamaredon Ptero-family Run Key Persistence with Prior PowerShell Activity

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•3

Detects persistence mechanisms via Registry Run keys or Startup folder shortcuts created by PowerShell, WScript, or CScript that are associated with the Gamaredon (ACTINIUM) threat group. The rule correlates these persistence events with prior execution of Ptero-family malware or suspicious encoded PowerShell commands on the same endpoint within a one-hour window.