Gamaredon Ptero-family PowerShell execution with phishing parent or workers.dev C2

Ibrahim Saud@tektrix

•updated Jun 26, 2026•2•0•12

Detects suspicious PowerShell activity potentially associated with the 'Ptero' malware family. The rule correlates several behaviors: direct invocation of PowerShell with known Ptero-related script names, execution spawned by common phishing delivery parents (such as Office applications or web scripting engines), PowerShell downloading files from Cloudflare Workers domains, and the correlation of PowerShell network download activity with subsequent registry-based persistence modifications.