malware

POWERSTATS S0223

Type: malware
Platform: Windows
Created: 18 April 2018
Last modified: 16 April 2025

POWERSTATS is a PowerShell-based first stage backdoor used by MuddyWater. [1]

TechniquesTop 10%

TacticsTop 11%

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

POWERSTATS MITRE reference S0223

Data from Local System T1005 ↗

POWERSTATS can upload files from compromised hosts.2

Collection22 detection rules

System Network Configuration Discovery T1016 ↗

POWERSTATS can retrieve IP, network adapter configuration information, and domain from compromised hosts.3 4

Discovery25 detection rules

Command Obfuscation T1027.010 ↗

POWERSTATS uses character replacement, PowerShell environment variables, and XOR encoding to obfuscate code. POWERSTATS's backdoor code is a multi-layer obfuscated, encoded, and compressed blob. 5 6 POWERSTATS has used PowerShell code with custom string obfuscation 7

Stealth13 detection rules

Junk Code Insertion T1027.016 ↗

POWERSTATS has used useless code blocks to counter analysis.8

Stealthno detection rules

Scheduled Transfer T1029 ↗

POWERSTATS can sleep for a given number of seconds.9

Exfiltrationno detection rules

System Owner/User Discovery T1033 ↗

POWERSTATS has the ability to identify the username on the compromised host.10

Discovery47 detection rules

Standing S0223

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques27Top 10%

90th percentile · 90% of 825 ATT&CK software entries have this many Enterprise techniques or fewer.

Tactics9Top 11%

89th percentile · 89% of 825 ATT&CK software entries have this many tactics spanned or fewer.

Threat group161% tie · 22 values

61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.

Campaigns085% tie · 8 values

85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique20med47th pct

47th percentile · 53% of 825 ATT&CK software entries have more detection rules per technique.

Tests / technique10medTop 9%

91st percentile · 91% of 825 ATT&CK software entries have this many atomic tests per technique or fewer.

Data comps / technique4med54% tie · 11 values

54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.

Mitigations / technique1med57th pct

57th percentile · 57% of 825 ATT&CK software entries have this many mitigations per technique or fewer.

5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this malware’s 27 Enterprise techniques.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 0Sigma rules (cumulative) · 765Splunk ESCU (cumulative) · 379

Standing S0223

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
Splunk	The following analytic detects the use of commands to add or set exclusions in Windows Defender. It (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Defense Impairment Disable or Modify Tools	-	medium	Teoderick Contreras, Nasreddine Bencherchali, Splunk	2021-11-25	2026-06-08	773b66fe-4dd9-11ec-8289-acde48001122
	Detects execution of "reg.exe" commands with the "add" or "copy" flags on safe boot registry keys. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Defense Impairment Disable or Modify Tools	-	high	Nasreddine Bencherchali (Nextron Systems)	2022-09-02	2024-03-19	d7662ff6-9e97-4596-a61d-9839e32dee8d
	Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database). (...)	Generic	test	pipe_created	windows	Sysmon	Collection Data from Local System	-	medium	Roberto Rodriguez @Cyb3rWard0g	2021-10-08	2023-11-30	1ea13e8c-03ea-409b-877d-ce5c3d2c1cb3
	Detects the deletion of the "Zone.Identifier" ADS. (...)	Hunting	test	file_delete	windows	Sysmon	Stealth Indicator Removal File Deletion	-	low	frack113	2023-09-04	—	7eac0a16-5832-4e81-865f-0268a6d19e4b
	Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. (...)	Generic	test	file_delete	windows	Sysmon	Stealth Indicator Removal File Deletion	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-09-04	2025-07-04	3109530e-ab47-4cc6-a953-cac5ebcc93ae
	Detects javaw.exe in AppData folder as used by Adwind / JRAT	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Visual Basic JavaScript	-	high	Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community	2017-11-10	2022-10-09	1fac1481-2dbc-48b2-9096-753c49b4ec71
	Detects javaw.exe in AppData folder as used by Adwind / JRAT	Generic	test	file_event	windows	Sysmon	Execution Command and Scripting Interpreter Visual Basic JavaScript	-	high	Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community	2017-11-10	2022-12-02	0bcfabcb-7929-47f4-93d6-b33fb67d34d1
	Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe	Generic	test	ps_module	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell	-	medium	Roberto Rodriguez @Cyb3rWard0g	2019-08-11	2025-10-17	64e8e417-c19a-475a-8d19-98ea705394cc
	Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe	Generic	test	pipe_created	windows	Sysmon	Execution Command and Scripting Interpreter PowerShell	-	medium	Roberto Rodriguez @Cyb3rWard0g, Tim Shelton	2019-09-12	2025-10-07	58cb02d5-78ce-4692-b3e1-dce850aae41a
	Detects code fragments found in small and obfuscated AMSI bypass PowerShell scripts	Generic	test	ps_script	windows	PowerShell	Defense Impairment Disable or Modify Tools	-	high	Florian Roth (Nextron Systems)	2022-11-09	—	e0d6c087-2d1c-47fd-8799-3904103c5a98
	Detects attempts to disable AMSI (Anti-Malware Scan Interface) by modifying the AmsiEnable registry value. (...)	Generic	experimental	registry_set	windows	Sysmon · WinEventLog Security	Defense Impairment Disable or Modify Tools	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-12-25	—	aa37cbb0-da36-42cb-a90f-fdf216fc7467
	Detects activity that indicates a user disabling the ability for Antivirus mini filter to inspect a "Dev Drive".	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Defense Impairment Disable or Modify Tools	-	high	@kostastsale, Nasreddine Bencherchali (Nextron Systems)	2023-11-05	2024-08-16	31e124fb-5dc4-42a0-83b3-44a69c77b271
	Detects the removal or uninstallation of an application via "Wmic.EXE".	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Windows Management Instrumentation	-	medium	frack113	2022-01-28	2024-07-02	b53317a0-8acf-4fd1-8de8-a5401e776b96
	Detects an attempt to terminate a process via "wmic" with the "call terminate" flag. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Windows Management Instrumentation	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-09-11	—	49d9671b-0a0a-4c09-8280-d215bfd30662
	Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.	Generic	experimental	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	heyyanu	2026-03-26	—	557e3bd3-7f21-495d-8d50-7c8bdfb8041c
	Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.	Generic	test	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	Pushkarev Dmitry	2020-06-28	2025-12-03	401e5d00-b944-11ea-8f9a-00163ecd60ae
	Detects DNS queries made by "AppInstaller.EXE". (...)	Generic	test	dns	windows	Sysmon	Command and Control Ingress Tool Transfer	-	medium	frack113	2021-11-24	2023-11-09	7cff77e1-9663-46a3-8260-17f2e1aa9d0a
	Detects execution of GfxDownloadWrapper.exe with a URL as an argument to download file.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Ingress Tool Transfer	-	medium	Victor Sergeev, oscd.community	2020-10-09	2023-10-18	eee00933-a761-4cd0-be70-c42fe91731e7
	Detects actions that disable Address Space Layout Randomization (ASLR) in Linux, including: - Use (...)	Generic	experimental	process_creation	linux	Linux Auditd	Defense Impairment Disable or Modify Tools Privilege Escalation, Stealth Process Injection Proc Memory	-	high	Milad Cheraghi	2025-05-26	2025-12-05	e497a24e-9345-4a62-9803-b06d7d7cb132
	Detect changes in auditd configuration files	Generic	test	file_event	linux	Linux Auditd	Defense Impairment Disable or Modify Tools	-	high	Mikhail Larin, oscd.community	2019-10-25	2021-11-27	977ef627-4539-4875-adf4-ed8f780c4922
	Detects deletion of an Amazon Bedrock guardrail, which may indicate attempts to remove model safety (...)	Generic	experimental	cloud_audit	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify Tools	-	medium	Marco Pedrinazzi (@pedrinazziM) (InTheCyber)	2026-07-10	—	59b70e4d-dd17-44a9-b740-acf07ae3eb6a
	Detects updates to an Amazon Bedrock guardrail, which may indicate attempts to weaken model safety c (...)	Generic	experimental	cloud_audit	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify Tools	-	medium	Marco Pedrinazzi (@pedrinazziM) (InTheCyber)	2026-07-10	—	1c722651-254a-4b04-a9f4-99b62a2d0a1f
	Detects changes to the EC2 instance startup script. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Unix Shell	-	high	faloker	2020-02-12	2022-06-07	1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df
	An attempt to export an AWS EC2 instance has been detected. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Collection Data from Local System Exfiltration Transfer Data to Cloud Account	-	low	Diogo Braz	2020-04-16	2022-10-05	54b9a76a-3c71-4673-b4b3-2edb4566ea7b
	Detects successful deletion or disabling of an AWS GuardDuty detector, possibly by an attacker trying to avoid detection of its malicious activities. (...)	Generic	experimental	cloud_audit	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify Tools Disable or Modify Cloud Log	-	high	suktech24	2025-11-27	—	d2656e78-c069-4571-8220-9e0ab5913f19
	Detects updates of the GuardDuty list of trusted IPs, perhaps to disable security alerts against malicious IPs.	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify Tools	-	high	faloker	2020-02-11	2022-10-09	6e61ee20-ce00-4f8d-8aee-bedd8216f7e3
	Detects evade to Macie detection.	Unsupported	unsupported	cloud_audit	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify Tools	-	medium	Sittikorn S	2021-07-06	2023-03-24	91f6a16c-ef71-437a-99ac-0b070e3ad221
	Detects the modification of the findings on SecurityHub.	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify Tools	-	high	Sittikorn S	2021-06-28	—	a607e1fe-74bf-4440-a3ec-b059b9103157
	Detects file creation events linked to the Axios NPM supply chain compromise. (...)	Emerging	experimental	file_event	linux	Sysmon	Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	b7cb840c-11f6-47f7-b3ef-5524739c9077
	Detects file creation events linked to the Axios NPM supply chain compromise on macOS devices. (...)	Emerging	experimental	file_event	macos	-	Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	2db0458c-05c9-4069-a26f-77becd9c8c13
	Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. (...)	Emerging	experimental	process_creation	linux	Sysmon	Execution Command and Scripting Interpreter Unix Shell Python Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	0a23a62d-c5b3-468b-a072-25064a9a8c87
	Detects the macOS-specific execution chain of the plain-crypto-js malicious npm dependency in Axios NPM Package, including AppleScript execution via osascript, payload download, permission modification, execution, and cleanup.	Emerging	experimental	process_creation	macos	-	Execution Command and Scripting Interpreter AppleScript Unix Shell Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	a09ee860-31b3-4586-8a68-0ebd74ce0e5f
	Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise. (...)	Emerging	experimental	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell Visual Basic Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	f6c27ecc-d890-4452-80e6-2e274a10e097
Splunk	The following analytic detects when the risk-based step-up consent security setting in Azure AD is disabled. (...)	Generic	stable	account_management	-	Microsoft 365	Defense Impairment Disable or Modify Tools	-	medium	Mauricio Velazco, Splunk	2023-11-16	2026-05-13	875de3d7-09bc-4916-8c0a-0929f4ced3d8
	Detects when Events are deleted in Azure Kubernetes. (...)	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Defense Impairment Disable or Modify Tools	-	medium	Austin Songer @austinsonger	2021-07-24	2022-08-23	225d8b09-e714-479c-a0e4-55e6f29adf35
	Detects backup catalog deletions	Generic	test	-	windows	WinEventLog Application	Stealth Indicator Removal File Deletion	-	medium	Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection)	2017-05-12	2022-12-25	9703792d-fd9a-456d-a672-ff92efe4806a
	focuses on trivial artifacts observed in variants of prevalent offensive ps1 payloads, including Cob (...)	Generic	test	ps_module	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell	-	critical	ok @securonix invrep_de, oscd.community	2020-10-09	2022-12-25	8d31a8ce-46b5-4dd6-bdc3-680931f1db86
	Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Deobfuscate/Decode Files or Information Stealth Obfuscated Files or Information	-	high	Florian Roth (Nextron Systems)	2020-01-29	2023-01-26	e32d4572-9826-4738-b651-95fa63747e8a
	Detects changes to the bitbucket audit log configuration.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Defense Impairment Disable or Modify Tools	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	6aa12161-235a-4dfb-9c74-fe08df8d8da1
	Detects Bitbucket global secret scanning rule deletion activity.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Defense Impairment Disable or Modify Tools	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	e16cf0f0-ee88-4901-bd0b-4c8d13d9ee05
	Detects Bitbucket global SSH access configuration changes.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Defense Impairment Disable or Modify Tools Lateral Movement Remote Services SSH	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	16ab6143-510a-44e2-a615-bdb80b8317fc
	Detects when a secret scanning allowlist rule is added for projects.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Defense Impairment Disable or Modify Tools	-	low	Muhammad Faisal (@faisalusuf)	2024-02-25	—	42ccce6d-7bd3-4930-95cd-e4d83fa94a30
	Detects when a repository is exempted from secret scanning feature.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Defense Impairment Disable or Modify Tools	-	high	Muhammad Faisal (@faisalusuf)	2024-02-25	—	b91e8d5e-0033-44fe-973f-b730316f23a1
	Detects when secret scanning rule is deleted for the project or repository.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Defense Impairment Disable or Modify Tools	-	low	Muhammad Faisal (@faisalusuf)	2024-02-25	—	ff91e3f0-ad15-459f-9a85-1556390c138d
	Detects user data export activity.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Collection Data from Information Repositories Reconnaissance Gather Victim Org Information Identify Roles Discovery System Information Discovery	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	5259cbf2-0a75-48bf-b57a-c54d6fabaef3
	Detects user permission data export attempt.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Collection Data from Information Repositories Reconnaissance Gather Victim Org Information Identify Roles Discovery System Information Discovery	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	87cc6698-3e07-4ba2-9b43-a85a73e151e2
Splunk	The following analytic detects the use of `bitsadmin.exe` with the `transfer` parameter to download a remote object. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution, Persistence, Stealth BITS Jobs Command and Control Ingress Tool Transfer	-	medium	Michael Haag, Sittikorn S	2021-03-30	2026-10-02	80630ff4-8e4c-11eb-aab5-acde48001122
	Detects default file names outputted by the BloodHound collection tool SharpHound	Generic	test	file_event	windows	Sysmon	Discovery Account Discovery Local Account Domain Account Execution Command and Scripting Interpreter PowerShell Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	high	C.J. May	2022-08-09	2026-02-19	02773bed-83bf-469f-b7ff-e676e7d78bab
	Attempts to detect system changes made by Blue Mockingbird	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry Execution Windows Management Instrumentation	-	high	Trent Liffick (@tliffick)	2020-05-14	2022-10-09	c3198a27-23a0-4c2c-af19-e5328d49680e
	Attempts to detect system changes made by Blue Mockingbird	Emerging	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry Execution Windows Management Instrumentation	-	high	Trent Liffick (@tliffick)	2020-05-14	2023-08-17	92b0b372-a939-44ed-a11b-5136cf680e27

Title

Description