Gamaredon Ptero-family Registry Run Key Persistence via PowerShell or VBScript
Detects persistence mechanisms used by Gamaredon's Ptero-family implants (e.g., PteroSetup, PteroPSDoor) which modify Windows registry run keys to execute malicious scripts or binaries located in suspicious directories like APPDATA or TEMP. The detection specifically looks for the combination of registry run key modifications and the use of obfuscated or stealthy execution arguments associated with PowerShell, VBScript, or MSHTA.
Sigma
