Kazuar Backdoor Deployment via Gamaredon PteroPaste Loader with Scheduled Task Persistence

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•1

Detects the deployment of the Kazuar backdoor, initiated by the Gamaredon group's PteroPaste loader. The rule monitors for a suspicious file creation event where a PowerShell or rundll32 process writes a DLL to a user-writable directory (AppData/Local or AppData/Roaming), followed immediately by the creation of a scheduled task (using schtasks) designed to trigger the execution of the dropped DLL via system binaries such as regsvr32, rundll32, or mshta.