Gamaredon PteroSetup USB Propagation – wscript/mshta Execution from Removable Drive

Ibrahim Saud@tektrix

•updated Jun 26, 2026•1•0•4

Detects the execution of script interpreters (wscript.exe, mshta.exe, cscript.exe) where the parent process, process path, or command line originates from a removable drive (drive letters D: through Z:). This is a common pattern for USB-based malware propagation and execution.