Description
[POWRUNER](https://attack.mitre.org/software/S0184) is a PowerShell script that sends and receives commands to and from the C2 server. (Citation: FireEye APT34 Dec 2017)
External References
Techniques Used by This Malware
- T1012 — Query Registry
- T1016 — System Network Configuration Discovery
- T1033 — System Owner/User Discovery
- T1047 — Windows Management Instrumentation
- T1049 — System Network Connections Discovery
- T1053.005 — Scheduled Task
- T1057 — Process Discovery
- T1059.001 — PowerShell
- T1059.003 — Windows Command Shell
- T1069.001 — Local Groups
- T1069.002 — Domain Groups
- T1071.001 — Web Protocols
- T1071.004 — DNS
- T1082 — System Information Discovery
- T1083 — File and Directory Discovery
- T1087.002 — Domain Account
- T1105 — Ingress Tool Transfer
- T1113 — Screen Capture
- T1132.001 — Standard Encoding
- T1518.001 — Security Software Discovery