Turla Kazuar Backdoor Deployment via Gamaredon PowerShell Loader Chain

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•1

This rule monitors for patterns associated with the Gamaredon (ACTINIUM) threat group's PowerShell loaders (e.g., Ptero-family) and the Kazuar backdoor. It specifically detects indicators such as malicious PowerShell command lines, NTFS alternate data stream manipulation, and suspicious scheduled task creation.