S0139 PowerDuke

malwareEnterprise

platformsWindows

also known asPowerDuke

PowerDuke is a backdoor that was used by APT29 in 2016. It has primarily been delivered through Microsoft Word or Excel attachments containing malicious macros.

techniques used (15)

ATT&CK techniques this enables or maps to.

T1010Application Window Discovery
T1016System Network Configuration Discovery
T1027.003Steganography
T1033System Owner/User Discovery
T1057Process Discovery
T1059.003Windows Command Shell
T1070.004File Deletion
T1082System Information Discovery
T1083File and Directory Discovery
T1105Ingress Tool Transfer
T1124System Time Discovery
T1218.011Rundll32
T1485Data Destruction
T1547.001Registry Run Keys / Startup Folder
T1564.004NTFS File Attributes

used by groups (1)

Threat groups associated with this.

G0016APT29

Detected by (Sigma) (4)

Sigma detection rules related to this.

19b041f6-e583-40dc-b842-d6fa8011493fHackTool Named File Stream Createdhigh
b69888d4-380c-45ce-9cf9-d9ce46e67821Hidden Executable In NTFS Alternate Data Streammedium
52182dfb-afb7-41db-b4bc-5336cb29b464Suspicious File Download From File Sharing Websites - File Streamhigh
ae02ed70-11aa-4a22-b397-c0d0e8f6ea99Unusual File Download From File Sharing Websites - File Streammedium

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan