Gamaredon PteroVDoor/PteroPSDoor VBScript execution and Run key persistence
Detects suspicious execution of scripting hosts (wscript.exe, cscript.exe, mshta.exe) that are commonly leveraged by the Gamaredon threat group. The rule specifically flags VBScript/HTA execution originating from temporary directories and monitors for the creation of persistence via Windows Registry Run keys.
Splunk (SPL)
