POWRUNER

MITRE ATT&CK: S0184 View on attack.mitre.org

Aliases: POWRUNER

Malware type
rat
Family
Malware family
Operating systems
windows
Profile updated
2026-07-07 15:45:14

Targeted industries: government-and-public-sector energy-and-utilities technology-and-telecommunications

Context

POWRUNER is a PowerShell script that sends and receives commands to and from the C2 server.

Detection coverage

  • 577 Sigma rules

Malware & tools used

  • System Network Configuration Discovery (attack-pattern)
  • Web Protocols (attack-pattern)
  • Windows Management Instrumentation (attack-pattern)
  • Process Discovery (attack-pattern)
  • DNS (attack-pattern)
  • System Owner/User Discovery (attack-pattern)
  • Security Software Discovery (attack-pattern)
  • Domain Groups (attack-pattern)
  • Local Groups (attack-pattern)
  • Domain Account (attack-pattern)
  • File and Directory Discovery (attack-pattern)
  • System Information Discovery (attack-pattern)
  • Windows Command Shell (attack-pattern)
  • PowerShell (attack-pattern)
  • Standard Encoding (attack-pattern)
  • Ingress Tool Transfer (attack-pattern)
  • Query Registry (attack-pattern)
  • System Network Connections Discovery (attack-pattern)
  • Scheduled Task (attack-pattern)
  • Screen Capture (attack-pattern)

Used by threat actors

Reports & references

  • Mandiant — Targeted Attack In Middle East By Apt34 (report)
  • cyware.com — Apt34 The Helix Kitten Cybercriminal Group Loves To Meow Middle Eastern And International Organizations 48Ae (report)
  • boozallen.com — Dark Labs Discovers Apt34 Malware Variants (report)
  • malpedia.caad.fkie.fraunhofer.de — Ps1.Powruner (report)
  • MITRE ATT&CK — S0184 (report)

External references