Living-off-the-Land Attack: PowerDrop

Originally published by ThreatLocker.On June 6, 2023, Adlumin Threat Research discovered a living-off-the-land attack, PowerDrop, using a malicious PowerShell script to target the US aerospace industry. LOTL attacks leverage powerful built-in tools to masquerade as legitimate processes. Therefore, they do not trigger any alerts. Here’s how PowerDrop was able to use this to its advantage. PowerDrop Analysis PowerDrop can be classified as a Remote Access Tool (RAT). This type of malicious so...

adlumin aerospace aerospace industry alerts analysis attack attacks industry june lotl malicious powerdrop powershell powershell script processes research script target threat threatlocker threat research tools trigger