Gamaredon HTML Smuggling Obfuscated PowerShell Execution
Detects malicious PowerShell activity associated with the Gamaredon group, specifically targeting obfuscated command lines used for HTML smuggling and downloader execution. This rule monitors for combined Base64 and HTML entity decoding, .NET reflection-based assembly loading, suspicious mshta.exe spawning PowerShell, and PowerShell creating HTML files.
Microsoft Sentinel (KQL)
