Gamaredon PteroSetup/PteroPaste removable media propagation with implant correlation
Detects the creation of potentially malicious executable or script files (.exe, .lnk, .vbs, .ps1, .hta) or autorun.inf files on removable drives (D-Z) initiated by common script interpreters or suspicious processes. This activity is then correlated with prior detections of Gamaredon (ACTINIUM/Primitive Bear) implant activity, such as Ptero-family malware, specific obfuscated PowerShell patterns, or HTML smuggling delivery via mail/Office clients on the same host within a 24-hour window.
Microsoft Sentinel (KQL)
