Gamaredon HTML Smuggling and Encoded PowerShell Execution (Ptero Toolset)

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•1

This rule detects execution patterns associated with the Gamaredon (Shuckworm) group's Ptero-family of malware. It specifically monitors for encoded PowerShell commands, the use of Invoke-Expression, and the execution of mshta.exe or wscript.exe spawned by Office applications or email clients, which is characteristic of Gamaredon's HTML smuggling and malicious document delivery techniques.