Gamaredon WinRAR Exploitation: Detecting ADS Abuse and Telegram C2

---
title: Gamaredon WinRAR ADS Payload Execution
id: 8a2b1c3d-4e5f-6789-0123-456789abcdef
status: experimental
description: Detects execution of binaries hidden in Alternate Data Streams, a technique used by Gamaredon to hide payloads delivered via WinRAR exploits.
references:
 - https://securityaffairs.com/193112/intelligence/gamaredon-uses-winrar-vulnerability-to-launch-modular-spy-campaign-on-ukrainian-targets.html
author: Security Arsenal
date: 2026/01/15
tags:
 - attack.defense_evasion
 - attack.t1564.004
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - ':\'
      - ':$'
  filter_legit_drivers:
    Image|endswith:
      - '\svchost.exe'
      - '\services.exe'
  filter_standard_streams:
    CommandLine|contains:
      - ':$DATA'
  condition: selection and not 1 of filter*
falsepositives:
  - Legacy software accessing file streams
  - Administrative tools
level: high
---
title: Gamaredon Telegram C2 Resolution
id: 9b3c2d4e-5f6a-7890-1234-567890abcdef
status: experimental
description: Detects non-browser processes resolving or connecting to Telegram domains, indicative of Gamaredon C2 activity using Telegram for infrastructure.
references:
 - https://securityaffairs.com/193112/intelligence/gamaredon-uses-winrar-vulnerability-to-launch-modular-spy-campaign-on-ukrainian-targets.html
author: Security Arsenal
date: 2026/01/15
tags:
 - attack.command_and_control
 - attack.t1102.002
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationHostname|contains:
      - 'telegram.org'
      - 't.me'
    Image|endswith:
      - '\chrome.exe'
      - '\firefox.exe'
      - '\edge.exe'
      - '\msedge.exe'
      - '\opera.exe'
      - '\telegram.exe'
  filter: selection
  condition: not filter
falsepositives:
  - Legitimate messaging apps not whitelisted
level: medium

// Hunt for Alternate Data Stream usage via PowerShell or CMD
DeviceProcessEvents
| where Timestamp > ago(30d)
| where ProcessCommandLine has ":" 
| where ProcessCommandLine has ".exe" or ProcessCommandLine has ".dll"
| where ProcessCommandLine !contains ":$DATA" 
| where ProcessCommandLine !contains ":\\Windows\\"
| project Timestamp, DeviceName, InitiatingProcessAccountName, ProcessCommandLine, InitiatingProcessFileName, FolderPath
| order by Timestamp desc


// Hunt for suspicious processes connecting to Telegram infrastructure
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has "telegram.org" or RemoteUrl has "t.me"
| where InitiatingProcessFileName !in ("chrome.exe", "firefox.exe", "msedge.exe", "opera.exe", "telegram.exe")
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort
| order by Timestamp desc

-- Hunt for processes spawning from suspicious ADS locations
SELECT Pid, Name, CommandLine, Exe, Username
FROM pslist()
WHERE Exe =~ ":\\" AND Name NOT IN ("svchost.exe", "explorer.exe")

# Remediation Script: Scan for Executable Payloads in ADS
# Run as Administrator

Write-Host "[+] Scanning C: drive for executables hidden in Alternate Data Streams..." -ForegroundColor Cyan

$Drives = @("C:\")
$SuspiciousExtensions = @(".exe", ".dll", ".bat", ".ps1", ".scr")

foreach ($Drive in $Drives) {
    try {
        # Find files with streams
        $Files = Get-ChildItem -Path $Drive -Recurse -ErrorAction SilentlyContinue | 
                  ForEach-Object { 
                      Get-Item -Path $_.FullName -Stream * -ErrorAction SilentlyContinue 
                  } | 
                  Where-Object { $_.Stream -ne ':$DATA' }

        foreach ($File in $Files) {
            # Heuristic: Check if stream name resembles an executable or if the base file is a common decoy
            if ($SuspiciousExtensions -contains [System.IO.Path]::GetExtension($File.Stream)) {
                Write-Host "[!] Suspicious Stream Found: $($File.FileName) :: Stream: $($File.Stream)" -ForegroundColor Red
                # Optional: Remove the stream (Uncomment to remediate)
                # Remove-Item -Path "$($File.FileName)" -Stream $File.Stream -Force
            }
        }
    }
    catch {
        Write-Host "[-] Error scanning $Drive : $_" -ForegroundColor Yellow
    }
}
Write-Host "[+] Scan complete." -ForegroundColor Green