Procedure examples

POWRUNER may query the Registry by running reg query on a victim.

POWRUNER may collect network configuration data by running ipconfig /all on a victim.

POWRUNER may collect information about the currently logged in user by running whoami on a victim.

POWRUNER may use WMI when collecting information about a victim.

POWRUNER may collect active network connections by running netstat -an on a victim.

POWRUNER persists through a scheduled task that executes it every minute.

POWRUNER may collect process information by running tasklist on a victim.

POWRUNER is written in PowerShell.

POWRUNER can execute commands from its C2 server.

POWRUNER may collect local group information by running net localgroup administrators or a series of other commands on a victim.

POWRUNER may collect domain group information by running net group /domain or a series of other commands on a victim.

POWRUNER can use HTTP for C2 communications.

POWRUNER can use DNS for C2 communications.

POWRUNER may collect information about the system by running hostname and systeminfo on a victim.

POWRUNER may enumerate user directories on a victim.

POWRUNER may collect user account information by running net user /domain or a series of other commands on a victim.

POWRUNER can download or upload files from its C2 server.

POWRUNER can capture a screenshot from a victim.

POWRUNER can use base64 encoded C2 communications.

POWRUNER may collect information on the victim's anti-virus software.