--- analysis: A simple detection rule on tebi.io or WMI commands might be too noisy in environments with heavy administrative automation. This hunt pivots between the unique script-based timer logic (3.6m ms) and the rare combination of profile/disk discovery across three different telemetry surfaces, using stack-counting to isolate the stealer. blind_spots: - id: script-logging-gap question: whether the orchestrator script executed if block logging is disabled or if the script is heavily obfuscated requires: hb_script_activity with full block logging enabled risk: The hunt may miss the initial orchestrator trigger, relying solely on process discovery commands and DNS traffic which are easier for admins to overlook. stage: drive-and-profile-discovery - id: s3-provider-rotation question: whether the adversary has rotated from tebi.io to another S3 provider requires: hb_http_activity risk: The hunt matches specific known domains; a new infrastructure choice makes the exfiltration invisible to the DNS step. stage: s3-exfiltration coverage: - stage: drive-and-profile-discovery status: covered steps: - orchestrator-timer-logic - rare-wmi-discovery - stage: s3-exfiltration status: covered steps: - exfil-dns-lookups - reason: This is handled in the GammaLoad hunt, which focuses on the initial execution and staging. stage: execution-powershell-dropper status: out_of_scope - reason: Registry staging requires detailed analysis of HKCU\Printers hive writes, belonging to a loader-focused hunt. stage: registry-payload-staging status: out_of_scope - reason: A standard detection rule for suspicious Run keys already covers the persistence mechanism used to relaunch the orchestrator. stage: persistence-run-key-pointer status: existing_rule guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: keep-as-periodic-hunt justification: Detecting the document scanning and exfiltration phase is the last opportunity to prevent the loss of sensitive data. Since Gamaredon heavily targets documents for espionage, a negative result across the estate provides critical assurance that active theft is not underway. methodology: model-assisted trigger: intel-report hypothesis: An adversary is using a recurring PowerShell timer to discover documents across user profiles and local/network drives, then exfiltrating them to an S3-compatible storage endpoint. labels: - hunt - attack.t1041 - attack.t1047 - attack.t1059.001 - attack.t1555 name: 'Gamaredon Gammasteel: Drive Discovery and S3 Exfiltration' parameters: exfil_domains: default: - tebi.io description: Known exfiltration domains used by Gammasteel. from: kind: article observed: '2026-06-11' ref: sekoia type: list[domain] lookback_days: default: '14' description: Days of history to examine. type: number scope_hosts: default: [] description: Hosts identified in the scoping step; leave empty to hunt across the entire estate. type: list[host] timer_interval: default: '3600000' description: The one-hour interval in milliseconds used by the orchestrator timer. from: kind: article observed: '2026-06-11' ref: sekoia type: string provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://www.sekoia.com/blog/fsbs-matryoshka-3-3-gamaredons-gifts-that-keeps-unpacking-gammasteel gates: - dry-run - lint - critic model: hb_google/gemini-3-flash-preview rationale: Prioritize workstations and file servers where sensitive documents are stored. Ensure PowerShell Script Block Logging (Event ID 4104) is enabled, as the hunt relies on script text visibility. references: - name: "FSB\u2019s matryoshka #3/3: Gamaredon's Gammasteel Infostealer" url: https://www.sekoia.com/blog/fsbs-matryoshka-3-3-gamaredons-gifts-that-keeps-unpacking-gammasteel related: - hunt: gamaredon-gammaload-stager reason: GammaLoad is responsible for the registry staging that the orchestrator analyzed in this hunt later retrieves and executes. relation: precedes - hunt: gammasteel-registry-staging relation: follows scenario: stages: - name: PowerShell Dropper Execution observables: - powershell.exe -nol -nop -enc - Start-Process -FilePath "powershell" -ArgumentList "-noexit" - -WindowStyle Hidden - Global\assembly307 slug: execution-powershell-dropper tactic: execution techniques: - T1059.001 - name: Fileless Registry Staging via DPAPI observables: - HKCU\Printers - KeZdDboas5kpxbkgxxvBx - ConvertTo-SecureString - ConvertFrom-SecureString - 71 PowerShell functions slug: registry-payload-staging tactic: defense-evasion techniques: - T1059.001 - name: Persistence via Run Key Pointer observables: - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run - 'Value name: $env:os' - YxwHku2chu0bznt3kkyAB - powershell.exe -w hidden -command "$a='HKCU:\Printers'; $b=Get-ItemProperty ..." slug: persistence-run-key-pointer tactic: persistence techniques: - T1547.001 - name: WMI Drive and Profile Discovery observables: - gwmi win32_userprofile - S-1-5-21 - Get-PSDrive -PSProvider FileSystem - Get-CimInstance Win32_LogicalDisk - System.Timers.Timer - 'Interval: 3600000' slug: drive-and-profile-discovery tactic: discovery techniques: - T1047 - T1555 - name: Data Exfiltration to S3 Storage observables: - tebi.io - MD5 hash deduplication log - plLmfuh4uctxjtrQSXC slug: s3-exfiltration tactic: exfiltration techniques: - T1041 summary: Gamaredon's GammaSteel infostealer utilizes an advanced fileless mechanism, staging 71 encrypted PowerShell functions directly in the Windows registry using DPAPI. The malware achieves persistence through Run key pointers and employs recurring WMI-based scans and hardware listeners to identify and exfiltrate user documents to S3-compatible cloud storage. series: index: 2 slug: fsb-s-matryoshka-3-3-gamaredon-s-gammasteel-infostealer title: "FSB\u2019s matryoshka #3/3: Gamaredon's Gammasteel Infostealer" total: 2 severity: high targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent tlp: clear type: investigation --- # Gamaredon Gammasteel: Drive Discovery and S3 Exfiltration This hunt targets the document discovery and exfiltration phase of Gammasteel, a modular stealer used by Gamaredon. The adversary establishes a one-hour recurring timer in PowerShell to trigger document scanning across all user profiles and logical disks. The hunt identifies this timer-based orchestration in script blocks, then fans out to detect the resulting WMI discovery commands and DNS resolutions to the known S3-compatible exfiltration provider. By pivoting from script-based triggers to prevalence-filtered process commands, the hunt separates automated malicious discovery from standard administrative activity. ## orchestrator-timer-logic Find PowerShell script blocks containing the specific one-hour timer interval or the Gammasteel orchestrator function name. ```sqlite target=endpoint role=scoping params=(lookback_days=lookback_days, timer_interval=timer_interval) ~~~yaml expected: Script blocks defining a System.Timers.Timer with a 3.6m ms interval. Silence means no scripts matching these specific orchestrator patterns were logged. reads: - device_hostname - script_content - script_path - time silence: not_evidence_of_absence source: hb_script_activity verified: dry-run verified_at: '2026-09-28' ~~~ SELECT device_hostname, script_path, script_content, time FROM hb_script_activity WHERE (script_content LIKE '%{{timer_interval}}%' OR LOWER(script_content) LIKE '%pllmfuh4uctxjtrqsxc%') AND time >= datetime('now', '-{{lookback_days}} days') ``` ## corroborate-activity parallel: - → exfil-dns-lookups - → rare-wmi-discovery join: → triage-stealer-behavior ## exfil-dns-lookups Match host DNS traffic against known Gamaredon exfiltration infrastructure. ```sqlite target=endpoint role=enrichment params=(lookback_days=lookback_days, exfil_domains=exfil_domains, scope_hosts=scope_hosts) ~~~yaml expected: Connections to tebi.io, especially from PowerShell processes. Silence suggests a shift in infrastructure or absence of the exfiltration phase. reads: - device_hostname - process_name - query_hostname - time silence: not_evidence_of_absence source: hb_dns_activity verified: dry-run verified_at: '2026-09-28' ~~~ SELECT device_hostname, process_name, query_hostname, COUNT(*) AS lookups, MIN(time) AS first_seen FROM hb_dns_activity WHERE instr(',' || '{{exfil_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, process_name, query_hostname ``` ## rare-wmi-discovery Identify rare execution of WMI queries for user profiles or logical disks that separate the stealer from normal admin noise. ```sqlite target=endpoint role=baseline params=(lookback_days=lookback_days, scope_hosts=scope_hosts) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: PowerShell or WMIC commands enumerating profiles or drives on a small number of hosts. Large host counts indicate standard environment discovery. prevalence: by: device_hostname key: - process_cmd_line rare_below: 3 reads: - device_hostname - process_cmd_line - time silence: not_evidence_of_absence source: hb_process_activity verified: dry-run verified_at: '2026-09-28' ~~~ SELECT LOWER(process_cmd_line) AS cmd, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%win32_userprofile%' OR LOWER(process_cmd_line) LIKE '%win32_logicaldisk%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY cmd HAVING hosts <= 3 ORDER BY hosts ``` ## triage-stealer-behavior ```agent target=hunter cite: required context: - orchestrator-timer-logic - exfil-dns-lookups - rare-wmi-discovery max_iterations: 4 objective: Determine if the PowerShell activity represents an automated document exfiltration tool by correlating the script timer logic with the subsequent drive discovery and network traffic. success_criteria: A verdict of malicious | suspicious | benign citing specific rows and script content segments. tools: - endpoint ``` ## evaluate-verdict if~: "the triage-stealer-behavior verdict is malicious for at least one host, particularly where script timer logic and exfiltration domains appear together" (confidence: high, judge=hunter) then: → isolate-endpoint indeterminate: → analyst-re-review unavailable: → analyst-re-review (blind_spot: script-logging-gap) else: → archive-hunt ## isolate-endpoint ```action target=endpoint ~~~yaml approval: required ~~~ Isolate the host from the network and preserve the PowerShell event logs and registry hives for HKCU\Printers. ``` → analyst-re-review ## analyst-re-review ```manual target=analyst Examine hb_file_activity for the suspicious PowerShell process to determine which user documents were accessed. Check for the presence of the Global\assembly307 mutex to confirm Gammasteel orchestrator execution. ``` → end ## archive-hunt ```manual target=analyst Summarize the hosts that showed timer activity vs those that showed DNS exfiltration. Note any false positives from legitimate administrative WMI scripts. ``` → end