Gamaredon PteroPSDoor/PteroVDoor PowerShell Backdoor with Run Key Persistence

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•1

This rule detects the execution of PowerShell with hidden window styles and encoded commands that is correlated with a concurrent update to Windows Registry Run or RunOnce keys. This combination is a common technique used by malware and adversaries to establish persistence on a host system.