Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
66 detections
Filters
Last updated
All Time
Detection languages
28
17
11
3
3
Contributors
29
17
8
3
3
Categories
47
23
20
18
12
Platforms
64
2
1
1
1
Products / Services
25
16
15
11
2
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
8
Detects Gamaredon (Armageddon) group activity characterized by Microsoft Office applications (winword.exe or excel.exe) writing to global template files (Normal.dotm or Personal.xlsb) to implant malicious macros, or dropping .vbs or .lnk files into startup or template directories to achieve persistence and facilitate further propagation.
Detects the creation of shortcut (.lnk) files in the Windows Startup directory by common archive extraction utilities, indicative of the Gamaredon/UAC-0226 GIFTEDCROOK campaign using CVE-2025-8088 to perform path traversal and gain persistence.
Detects malicious PowerShell command-line execution associated with the Gamaredon (Shuckworm/ACTINIUM) threat group's Ptero-family of tools. This rule flags PowerShell processes utilizing encoded commands (-enc, -EncodedCommand), hidden windows (-nop, -w hidden), and downloader cmdlets (DownloadString, DownloadFile, IEX) that include specific strings linked to the Ptero malware suite (e.g., PteroPaste, PteroVDoor, PteroPSDoor).
Detects instances where WinRAR.exe is observed writing potentially malicious script or link files (.hta, .vbs, .js, .ps1, .lnk) into the Windows Startup folder. This pattern is indicative of exploitation of CVE-2025-8088, a path traversal vulnerability in WinRAR often leveraged by the Gamaredon group to establish persistence.
Detects WinRAR creating a malicious VBS/VBE script within the Windows Startup folder using NTFS Alternate Data Streams, a behavior associated with the exploitation of CVE-2025-8088 by the Gamaredon threat group.
Detects suspicious child processes (such as PowerShell, CMD, or WScript) being spawned by Microsoft Office applications or email clients, which is indicative of exploitation activity consistent with Gamaredon spear-phishing campaigns. This specifically monitors for execution patterns attempting to deploy 'Ptero' family implants potentially following exploitation of vulnerabilities such as CVE-2025-8088.
Detects malicious PowerShell activity associated with the Gamaredon group, specifically targeting obfuscated command lines used for HTML smuggling and downloader execution. This rule monitors for combined Base64 and HTML entity decoding, .NET reflection-based assembly loading, suspicious mshta.exe spawning PowerShell, and PowerShell creating HTML files.
Detects execution of PowerShell commands indicative of Gamaredon (Shuckworm) threat group activity. The rule monitors for PowerShell processes utilizing command-line arguments typical of their 2025 downloader toolset (such as PteroPaste, PteroDee, and PteroCache), specifically combining encoded commands, in-memory execution (IEX/Invoke-Expression), and remote file fetching (DownloadString).
Detects instances where WinRAR.exe is observed writing potentially malicious script or link files (.hta, .vbs, .js, .ps1, .lnk) into the Windows Startup folder. This pattern is indicative of exploitation of CVE-2025-8088, a path traversal vulnerability in WinRAR often leveraged by the Gamaredon group to establish persistence.
Detects the use of rclone.exe to exfiltrate files to Dropbox, specifically looking for process execution patterns and network connections to Dropbox API endpoints consistent with the Gamaredon PteroBox exfiltration module.
This rule detects potential exploitation of CVE-2025-8088 involving WinRAR or unrar processing malicious archives with path traversal characters (../ or ..\). It identifies the extraction of script files (HTA, VBS, PS1, BAT) into the Windows Startup folder, followed by the execution of these files via mshta.exe or wscript.exe within a 30-second window, characteristic of Gamaredon group persistence mechanisms.
Detects execution of script interpreters (wscript.exe, cscript.exe) or HTML Application host (mshta.exe) when spawned by Microsoft Office applications (Winword, Excel, PowerPoint, Outlook) or mshta.exe. This pattern is characteristic of the Gamaredon group's spear-phishing delivery chains (e.g., PteroOdd, PteroDum) that utilize macro-enabled documents or malicious HTA files to execute malicious VBScript.
Detects potential second-stage deployment of the Kazuar backdoor on Windows hosts, following initial access activity associated with the Gamaredon group (using Ptero-family implants). The rule monitors for a sequence involving PowerShell-based loaders (PteroPaste, PteroVDoor, PteroSetup, or PteroDee) followed by or combined with suspicious encoded PowerShell commands and the creation of Kazuar-specific named pipes or artifact markers.
Detects HTTP and DNS requests directed towards the .workers.dev domain, which are commonly leveraged by threat actors for command and control (C2) redirection and domain fronting. This activity is frequently associated with the Gamaredon (Shuckworm/ACTINIUM) threat group's infrastructure.
Detects execution chains where Outlook launches a VBScript file that subsequently invokes PowerShell with encoded commands, characteristic of Gamaredon (ACTINIUM) threat activity. Additionally, it identifies the creation of VBScript/VBE files in temporary directories, which is consistent with the deployment of PteroVDoor or PteroPSDoor loaders.
Detects network activity associated with Gamaredon threat group backdoors (PteroVDoor and PteroPSDoor) exfiltrating data to S3-compatible cloud storage providers. The rule identifies suspicious outbound network requests to specific domains ('wasabisys.com', 'i3storage.com') originating from processes that are not common browsers or trusted software, or by command-line execution of PowerShell, curl, or wget.
Detects execution patterns associated with the Gamaredon group's spearphishing chains, specifically where PowerShell is invoked by common document or scripting applications (Winword, Excel, mshta, etc.) containing typical downloader flags (IEX, EncodedCommand). Additionally, it monitors for network connections from PowerShell to known dead-drop resolvers (e.g., telegra.ph, cloudflare workers) used by PteroOdd/Kazuar loaders.
Detects the execution of PowerShell or Windows script hosts containing a combination of WMI system enumeration queries (specifically targeting Win32_ComputerSystem) and common virtual machine/sandbox environment artifacts (vmware, vbox, sandbox). This behavior is consistent with the Gamaredon group's PteroSand malware performing environment fingerprinting to identify analysis environments and abort execution.
Detects persistence mechanisms via Registry Run keys or Startup folder shortcuts created by PowerShell, WScript, or CScript that are associated with the Gamaredon (ACTINIUM) threat group. The rule correlates these persistence events with prior execution of Ptero-family malware or suspicious encoded PowerShell commands on the same endpoint within a one-hour window.
This rule detects outbound network connections to common tunneling and proxy services (Cloudflare Tunnel, Cloudflare Workers, and Microsoft Dev Tunnels). These services are frequently abused by threat actors, such as the Gamaredon Group (ACTINIUM), to establish command-and-control (C2) channels and tunnel traffic to evade network-based detection systems.
Detects sandbox evasion techniques employed by the Gamaredon group using their PteroSand methodology. The rule monitors for WMI queries executed by suspicious parent processes to identify virtualization artifacts (VMware, VirtualBox) or system hardware/system information, which are characteristic of environment reconnaissance and timing-based checks prior to payload activation.
Page 1 of 4