Gamaredon - VBS obfuscation sequence using Split/ChrW (T1027)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•5

Detects highly obfuscated VBScript execution utilizing specific array splitting and character decoding loops used by GammaDrop. The rule specifically looks for the combination of 'Split' and 'ChrW' functions within VBScript command execution, which is indicative of a common obfuscation technique used by the Gamaredon APT group.