Detect POWRUNER by monitoring for suspicious PowerShell execution, obfuscated command lines, and unusual download or script-launch behaviour. Check for persistent autoruns, child processes created from scripting hosts, and network connections from user workstations to uncommon destinations. Use endpoint and proxy logs together to spot staging and post-exploitation activity early.
What POWRUNER detection looks for in telemetry
Detection works best when teams treat POWRUNER as a behaviour set, not a single signature. The most useful signals are PowerShell activity that looks engineered for evasion, script execution that spawns unexpected child processes, and process chains that do not match normal user work. That is why endpoint telemetry and proxy visibility need to be reviewed together, rather than in isolation.
Malware Guide is the right internal starting point when you need to translate those behaviours into broader malware tradecraft, including obfuscation, loaders, and evasion patterns.
Which host and network clues matter most
The strongest host clue is suspicious PowerShell execution, especially when the command line is obfuscated, encoded, compressed, or otherwise designed to hide intent. Teams should also look for scripting hosts creating children they rarely produce in normal operations, such as shells, download utilities, or other administrative tools launched at odd times. On the network side, user workstations reaching uncommon destinations during a script run is often the best confirmation that the activity is more than routine automation.
Persistence indicators matter because post-compromise staging often leaves residue. Autoruns, scheduled tasks, registry run keys, and other startup mechanisms can show that the actor expected to return. Correlating those artefacts with the first suspicious script execution helps separate initial delivery from follow-on activity and reduces the chance of treating the event as a one-off false positive.
For detection engineering, MITRE ATT&CK Enterprise Matrix is a useful external reference for mapping the observed process, persistence, and network behaviours to known adversary techniques.
How to triage and confirm likely compromise
Once suspicious PowerShell or script-launch behaviour is seen, triage should answer three questions: did the script launch something else, did it reach out to the network, and did it establish a way to come back later? If the answer is yes to all three, treat the case as a likely active intrusion path rather than an isolated execution anomaly. Endpoint and proxy logs together usually provide the fastest way to reconstruct the sequence.
Security teams should also preserve the full command line, parent-child process chain, and any related URL or domain lookups before containment actions change the evidence. That context is often what reveals whether the activity was staging, payload retrieval, lateral movement preparation, or post-exploitation tasking. If the same workstation also shows unusual persistence creation, the priority should shift from simple cleanup to compromise assessment.
SANS Security Resources provides practitioner-oriented detection and incident-handling material that can help teams turn those telemetry clues into a repeatable hunt workflow.
Risk and Threat Considerations
POWRUNER-style activity is risky because script hosts, PowerShell, and common admin tooling can blend into legitimate operations, giving the attacker a low-friction path to staging and follow-on action. The real danger is not just initial execution, but the combination of obfuscation, network reach-out, and persistence that can keep the intrusion alive after the first alert.
Failure mechanism: Defenders miss the attack when they inspect endpoint logs, proxy logs, or process trees separately, or when they dismiss obfuscated PowerShell as routine administration.
Impact: The actor can stage payloads, maintain persistence, and expand access before the compromise is fully recognised, increasing the cost of containment and the likelihood of broader lateral movement.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1059 — Command and Scripting Interpreter | POWRUNER detection centers on suspicious PowerShell and script execution. |
| T1053 — Scheduled Task/Job | Persistent autoruns and task-based persistence are core confirmation clues. | |
| T1071 — Application Layer Protocol | Network callbacks from user workstations to uncommon destinations are part of staging detection. | |
| Recommendation — Map script activity to T1059 and hunt for encoded or obfuscated command lines. Review scheduled tasks and autoruns for persistence created after the initial script run. Correlate outbound connections with suspicious scripting to identify staging traffic. | ||
| NIST CSF 2.0 | DE.CM-01 — Networks and network services are monitored to detect potential cybersecurity events | The question is about monitoring host and proxy telemetry to detect malicious activity. |
| DE.AE-02 — Detected events are analyzed to understand attack targets and methods | Triage requires analyzing process chains, persistence, and network behaviour as one event. | |
| RS.AN-01 — Notifications from detection systems are investigated | POWRUNER alerts need investigation of host and network indicators before containment. | |
| Recommendation — Monitor endpoint and proxy telemetry together to surface suspicious PowerShell activity. Analyze process, persistence, and network evidence as a single detection event. Investigate correlated alerts before deciding the activity is benign. | ||
Practitioner Guidance
What to prioritise: Start with the process chain, command line, and network destination for every suspicious PowerShell event. If those three elements line up, you have a stronger case for active malicious activity than any single indicator alone.
What to verify: Check whether the workstation has newly created autoruns, scheduled tasks, or registry run keys that appeared after the first script execution. That is the clearest sign that the event moved beyond simple execution into persistence.
Practitioner takeaway: The best POWRUNER detections are correlation problems, not signature problems, so teams should optimise for linked endpoint and proxy evidence that proves execution, staging, and persistence together.