Gamaredon Ptero-family PowerShell downloader activity detection

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•1

Detects execution of PowerShell or PowerShell ISE containing indicators associated with 'Ptero' malware families or known file-hosting services and infrastructure used for payload delivery or command-and-control. The rule specifically monitors for suspicious command-line strings and flags executions triggered by common persistence or infection vectors like Word documents, WMI, or scripting engines.