POWRUNER, Software S0184
Excerpt
POWRUNER, Software S0184 | MITRE ATT&CK®
Enterprise T1087 .002 Account Discovery: Domain Account
POWRUNER may collect user account information by running net user /domain or a series of other commands on a victim.[1]
Enterprise T1071 .001 Application Layer Protocol: Web Protocols POWRUNER can use HTTP for C2 communications.[1][2]
.004 Application Layer Protocol: DNS
POWRUNER can use DNS for C2 communications.[1][2]
Enterprise T1059 .001 Command and Scripting Interpreter: PowerShell POWRUNER is written in PowerShell.[1]
.003 Command and Scripting Interpreter: Windows Command Shell POWRUNER can execute commands from its C2 server.
[1]
Enterprise T1132 .001 Data Encoding: Standard Encoding
POWRUNER can use base64 encoded C2 communications.[1]…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by MITRE ATT&CK on attack.mitre.org.
More from MITRE ATT&CK43
- techdoc_lite-deliverables-numbered option.dotxMITRE ATT&CK · Added 16 Jun
- Cross-Platform Detection of Data Transfer to Cloud Account, Detection Strategy DET0573MITRE ATT&CK · Added 6 Apr
- Encrypted Channel, Technique T1573 - EnterpriseMITRE ATT&CK · Added 6 Apr
- Boot or Logon Autostart Execution: Time Providers, Sub-technique T1547.003 - EnterpriseMITRE ATT&CK · Added 6 Apr
