Skip to content

POWRUNER

Software · ATTACK:enterprise:S0184

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:S0184",
  "title": "POWRUNER",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0184",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--09b2cd76-c674-47cc-9f57-d2f2ad150a46",
  "external_id": "S0184",
  "domain": "enterprise",
  "created": "2018-01-16T16:13:52.465Z",
  "modified": "2025-04-25T14:42:38.309Z",
  "version": "1.1",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "POWRUNER"
    },
    {
      "source_name": "FireEye APT34 Dec 2017",
      "url": "https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html"
    }
  ]
}

Explicit source assertions (21)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0184 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0bd2ee1a-6202-4ff5-9a42-4869a276a92c

FireEye APT34 Dec 2017

ATTACK:enterprise:S0184 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--14b70990-48b0-482b-bd5a-3a99d9d9a653

FireEye APT34 Dec 2017 · FireEye APT34 Webinar Dec 2017

ATTACK:enterprise:S0184 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--35419603-7bc2-40f6-8e5d-4e7a8f13ebb7

FireEye APT34 Dec 2017

ATTACK:enterprise:S0184 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--408db284-4c7a-4ad4-8399-90a8102b4bfa

FireEye APT34 Dec 2017

ATTACK:enterprise:S0184 → uses → ATTACK:enterprise:T1071.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--49363ea2-b33e-4cc4-a283-ab7d30530c27

FireEye APT34 Dec 2017 · FireEye APT34 Webinar Dec 2017

ATTACK:enterprise:S0184 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5183147b-4563-4a01-a360-a419691e35f8

FireEye APT34 Dec 2017

ATTACK:enterprise:S0184 → uses → ATTACK:enterprise:T1518.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--52781f1e-4b91-4ff2-8f48-89e15bc40d42

FireEye APT34 Dec 2017

ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:S0184

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--52d3e8a9-8801-497f-b1e1-6d45e196c79b

FireEye APT34 Dec 2017

ATTACK:enterprise:S0184 → uses → ATTACK:enterprise:T1069.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--533deac3-2f27-4256-bb11-7d68d8824d47

FireEye APT34 Dec 2017

ATTACK:enterprise:S0184 → uses → ATTACK:enterprise:T1069.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5650777d-f905-4c09-8fd0-0e205178a830

FireEye APT34 Dec 2017

ATTACK:enterprise:S0184 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--61dd6d75-a95b-488d-9a1d-924563592df7

FireEye APT34 Dec 2017

ATTACK:enterprise:S0184 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9670979e-9785-45f0-a470-f591c97f6f8a

FireEye APT34 Dec 2017

ATTACK:enterprise:S0184 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a88332d2-d03f-4139-b11c-19e82459189b

FireEye APT34 Dec 2017

ATTACK:enterprise:S0184 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aabb13d6-a73b-42aa-8014-696b94ff2416

FireEye APT34 Dec 2017

ATTACK:enterprise:S0184 → uses → ATTACK:enterprise:T1059.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b4c7e12f-6921-4007-ab15-595969bf9eca

FireEye APT34 Dec 2017

ATTACK:enterprise:S0184 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b9109cd5-1b13-4376-a761-b68302879351

FireEye APT34 Dec 2017

ATTACK:enterprise:S0184 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c4d77981-d2e4-4a12-8e52-5b7464cdc8fd

FireEye APT34 Dec 2017

ATTACK:enterprise:S0184 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d078f862-c090-4e79-808b-ff69887a920c

FireEye APT34 Dec 2017

ATTACK:enterprise:S0184 → uses → ATTACK:enterprise:T1049

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e0cf8a56-e8e1-43b0-9efc-f167d1cf21de

FireEye APT34 Dec 2017

ATTACK:enterprise:S0184 → uses → ATTACK:enterprise:T1053.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ea5f9e1f-68fb-46dd-9e09-f66066808d0c

FireEye APT34 Dec 2017

ATTACK:enterprise:S0184 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ed522c9c-038b-43c0-af66-e81b954104f2

FireEye APT34 Dec 2017

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.