Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
66 detections
Filters
Last updated
All Time
Detection languages
28
17
11
3
3
Contributors
29
17
8
3
3
Categories
47
23
20
18
12
Platforms
64
2
1
1
1
Products / Services
25
16
15
11
2
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
8
Detects network connections to the hardcoded GammaSteel fallback C2 IP address (165.22.170.129) and domain (justsstop.ru). These hardcoded IOCs are used as a failsafe when primary S3 exfiltration fails or DDR configurations are lost, indicating an active data theft operation.
Detects curl.exe being used to fetch content from Telegram channels and saving it to the AppData\Local\Temp directory, indicative of Gamaredon Dead Drop Resolver (DDR) resolution.
Detects the execution of an Alternate Data Stream (ADS) payload located in the %TEMP% directory via wscript.exe, a critical persistence mechanism used by Gamaredon's GammaLoad.
Detects wscript.exe or cscript.exe executing a script hidden within an NTFS Alternate Data Stream (ADS). This technique is notably used by the Gamaredon group's GammaWorm to maintain fileless persistence and conceal malicious VBScript payloads (e.g., %USERPROFILE%:GTR).
Detects the execution of mshta.exe containing a URL with an '@' character to spoof a legitimate domain (e.g., www.bbc.com@malicious.com). This technique is used by Gamaredon in the GammaPhish stage to obfuscate the real C2 domain when launching initial HTA payloads.
Detects PowerShell command lines querying the HKCU:\Printers registry key and executing its contents via ScriptBlock creation. This technique is utilized by Gamaredon's GammaSteel malware for fileless registry staging and persistence.
Detects WMI queries targeting the win32_logicaldisk class and filtering for mediatype=null. This specific query is used by Gamaredon's GammaWorm to identify network drives and removable drives (such as USBs) for malware propagation.
Detects the use of curl.exe to download files from public Telegram channels to the user's Temp directory. This is indicative of a Dead Drop Resolver (DDR) technique utilized by the Gamaredon group to retrieve Command and Control (C2) configuration data.
Detects the modification of Windows Explorer registry keys (Hidden, ShowSuperHidden, HideFileExt) designed to conceal files and file extensions. This defense evasion technique is notably used by the Gamaredon group's GammaWorm to hide dropped payloads, replaced LNK files, and malicious directories.
Detects PowerShell script logic associated with GammaSteel's fileless registry staging encryption, specifically the use of ConvertTo-SecureString alongside the HKCU:\Printers path. This technique is used by Gamaredon to bind payload encryption to the active user session and hinder forensic analysis.
Detects the execution of mshta.exe containing a URL with an '@' character to spoof a legitimate domain (e.g., www.bbc.com@malicious.com), a technique used by Gamaredon in the GammaPhish stage to obfuscate the real C2 domain.
Detects registry modifications to Windows Explorer Advanced settings designed to hide file extensions, hidden files, and protected operating system files. This defense evasion technique is commonly used by malware, such as Gamaredon's GammaWorm, to conceal dropped payloads and replaced LNK files from the user.
Detects PowerShell executions associated with Gamaredon's GammaSteel persistence mechanism, which reconstructs a payload path from the HKCU:\Printers registry key and executes it using [scriptblock]::Create. This technique indicates an attempt to maintain access by leveraging registry keys for autostart execution and dynamic script execution.
Detects a specific WMI query used by malware, such as Gamaredon's GammaWorm, to discover network drives (e.g., SMB mounts) and low-cost USB drives for malware propagation by filtering for mediatype=null.
Detects the execution of wscript.exe targeting a script concealed within an Alternate Data Stream (ADS) in the user profile directory. This technique is heavily used by Gamaredon's GammaWorm for persistence and execution.
Detects the creation of .vbs or .vbe files in the Windows Startup folder. This technique is actively used by Gamaredon (leveraging CVE-2025-8088) to drop the GammaDrop payload for persistence.
Detects script engines (wscript.exe, mshta.exe, cscript.exe) making outbound network connections to Cloudflare Workers domains (*.workers.dev). This is a primary C2 channel utilized by Gamaredon for GammaLoad payload delivery and beaconing.
Detects wscript.exe launching mshta.exe to execute files in the temporary directory. This behavior is indicative of Gamaredon's GammaDrop launching the GammaLoad HTA payload.
Detects the creation of a scheduled task using 'schtasks create' in conjunction with 'wscript' and '/e:vbscript', which is a known persistence mechanism used by the ACTINIUM threat group.
Detects potential DLL side-loading of the Turla Kazuar backdoor using legitimate executables launched from unusual, actor-specific file paths.
Detects suspicious UltraVNC command line flag combination that indicate a auto reconnect upon execution, e.g. startup (as seen being used by Gamaredon threat group)
Page 3 of 4