Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
66 detections
Filters
Last updated
All Time
Detection languages
28
17
11
3
3
Contributors
29
17
8
3
3
Categories
47
23
20
18
12
Platforms
64
2
1
1
1
Products / Services
25
16
15
11
2
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
8
Detects persistence mechanisms used by Gamaredon's Ptero-family implants (e.g., PteroSetup, PteroPSDoor) which modify Windows registry run keys to execute malicious scripts or binaries located in suspicious directories like APPDATA or TEMP. The detection specifically looks for the combination of registry run key modifications and the use of obfuscated or stealthy execution arguments associated with PowerShell, VBScript, or MSHTA.
Detects Gamaredon Group activity involving the staging of malicious payloads using NTFS Alternate Data Streams (ADS) and hidden file attributes (PteroCache/PteroOdd). The rule monitors for three primary staging behaviors: the creation of ADS files via script interpreters (Office, wscript, PowerShell), the modification of file attributes to hidden or system (+H/+S) in sensitive paths, and the enumeration of ADS streams using 'dir /R'. These staging actions are correlated with subsequent process execution from user-writable directories (e.g., APPDATA, TEMP) within a 5-minute window to identify the full infection chain.
Detects the Gamaredon PteroVDoor malware chain, including initial execution of obfuscated VBScript files from Office applications or temporary folders, the spawning of PowerShell with obfuscated arguments, subsequent C2 communication over common ports to dynamic DNS domains, and secondary WMI event subscription persistence.
Detects execution chains attributed to the Gamaredon threat group (also known as Shuckworm/ACTINIUM). The rule monitors Microsoft Office applications (Word, Excel, PowerPoint, Equation Editor) spawning cmd.exe or powershell.exe, where the child process contains suspicious patterns such as base64 blobs, script download commands, or known Gamaredon Ptero-toolset strings (PteroPaste, PteroVDoor, PteroDee). This activity is correlated with a network connection to non-Microsoft infrastructure within 60 seconds of process execution.
Detects USB-based lateral movement and persistence techniques associated with the Gamaredon group (PteroOdd/PteroPaste). The rule monitors for the connection of removable media followed by the creation of LNK files targeting AppData/Temp directories or UNC paths by specific processes (Office, Scripting engines, PowerShell), and the subsequent creation or modification of autorun.inf files on the same removable device.
Detects sandbox evasion techniques used by the Gamaredon group's PteroSand malware. The rule monitors for WMI queries against system artifacts (Win32_ComputerSystem, Win32_BIOS, or Win32_VideoController) searching for virtualization-related strings (vmware, vbox, etc.), followed by a mandatory sleep/timeout delay of at least 60 seconds, and concludes by identifying the subsequent execution of a new process within the same lineage.
Detects execution of PowerShell commands associated with the Gamaredon Group's Ptero malware family. This rule monitors for suspicious PowerShell command lines (including encoded commands and common obfuscation patterns) originating from Office applications or temporary directories, correlated with network connections to known Gamaredon C2 domains or registry modifications to Run keys for persistence.
Detects persistence mechanisms associated with the Gamaredon Group (also known as Shuckworm/ACTINIUM) involving the Ptero-family of malware. The rule identifies suspicious combinations of encoded PowerShell commands (using -EncodedCommand, IEX, or FromBase64String), registry modification to Windows Run/RunOnce keys referencing suspicious interpreters (wscript, mshta, powershell, rundll32) within user profile paths, and command-line indicators of C2 activity such as DownloadString/WebClient or specific .ru/.online domain patterns.
Detects the execution of known Gamaredon (Shuckworm/ACTINIUM) VBScript-based payloads, including PteroVDoor, PteroPSDoor, PteroPaste, PteroDee, and PteroCache, executed via wscript.exe or cscript.exe. It also monitors for suspicious child process spawning behavior where these scripts or WinRAR launch mshta.exe, which is a common pattern observed in Gamaredon staging and lateral movement activities.
Detects suspicious execution of scripting hosts (wscript.exe, cscript.exe, mshta.exe) that are commonly leveraged by the Gamaredon threat group. The rule specifically flags VBScript/HTA execution originating from temporary directories and monitors for the creation of persistence via Windows Registry Run keys.
This rule monitors for patterns associated with the Gamaredon (ACTINIUM) threat group's PowerShell loaders (e.g., Ptero-family) and the Kazuar backdoor. It specifically detects indicators such as malicious PowerShell command lines, NTFS alternate data stream manipulation, and suspicious scheduled task creation.
This rule detects execution patterns associated with the Gamaredon (Shuckworm) group's Ptero-family of malware. It specifically monitors for encoded PowerShell commands, the use of Invoke-Expression, and the execution of mshta.exe or wscript.exe spawned by Office applications or email clients, which is characteristic of Gamaredon's HTML smuggling and malicious document delivery techniques.
Detects suspicious modifications to the HKCU\Console registry key used by Gamaredon's GammaLoad to cache C2 URLs for persistence across executions.
Detects the deployment of the Kazuar backdoor, initiated by the Gamaredon group's PteroPaste loader. The rule monitors for a suspicious file creation event where a PowerShell or rundll32 process writes a DLL to a user-writable directory (AppData/Local or AppData/Roaming), followed immediately by the creation of a scheduled task (using schtasks) designed to trigger the execution of the dropped DLL via system binaries such as regsvr32, rundll32, or mshta.
Identifies emails where the From header spoofing a government entity mismatches the envelope sender in MailEvents. This indicates a potential email spoofing attempt, often used in phishing campaigns.
Curl Download From Telegram Channel
Cortex XDR
Detects the use of curl.exe to download files from public Telegram channels to the user's Temp directory, indicative of Gamaredon Dead Drop Resolver (DDR) resolution.
Detects the execution of mshta.exe where the command line arguments reference a file with a .pdf extension. This technique is used by Gamaredon (GammaPhish) to execute disguised HTA payloads after WinRAR exploitation.
Detects suspicious modifications to the HKCU\Console registry key used by Gamaredon's GammaLoad to cache C2 URLs for persistence across executions.
Detects PowerShell script block contents indicating the manual bypassing of SSL certificate validation. This defense evasion technique is notably used by the Gamaredon GammaLoad third stage (which executes via an encoded command) to ensure successful connection to potentially untrusted or self-signed C2 infrastructure.
Suspicious MSHTA Fake Auth URL
Cortex XDR
Detects mshta.exe executing a remote URL that contains an '@' symbol, a technique used by Gamaredon (GammaPhish) to fake authentication and bypass naive URL filtering.
Detects WinRAR extracting and launching HTML applications (mshta.exe) or script interpreters (wscript.exe/cscript.exe). This behavior is indicative of the CVE-2025-8088 exploit chain used by Gamaredon to deploy GammaPhish and GammaLoad.
Page 2 of 4