GammaSteel Registry Persistence Execution

Duo Tech@duotech

•updated Jun 4, 2026•1•0•9

Detects PowerShell command lines querying the HKCU:\Printers registry key and executing its contents via ScriptBlock creation. This technique is utilized by Gamaredon's GammaSteel malware for fileless registry staging and persistence.