S0139: PowerDuke
MITRE ATT&CK S0139: PowerDuke Malware details for Windows, with detection guidance, relationships and mapped CVEs.
Security context for executives and security teams
PowerDuke matters because it represents a Windows backdoor associated in ATT&CK with macro-delivered Word or Excel attachments and follow-on host discovery, stealth, persistence, command execution, and file transfer behaviors. For leaders, the practical question is not whether this specific 2016 malware is present today, but whether the organization can reliably prevent, observe, and investigate the pattern: a user opens a malicious Office attachment, code executes on a Windows endpoint, the host is profiled, persistence is established, and additional tooling or commands may follow.
Executive priority
Prioritize this as a control-validation and readiness use case for phishing resilience, Office macro governance, Windows endpoint telemetry, and incident response evidence quality. The ATT&CK object has no official detection guidance, so assurance should come from proving that email controls, endpoint logging, persistence monitoring, and recovery controls can support timely decisions if a macro-delivered backdoor is suspected.
Technical view
Validate coverage on Windows endpoints for the behaviors linked to PowerDuke: Office-originated execution, Windows Command Shell activity, rundll32 proxy execution, Registry Run Key or Startup Folder persistence, discovery of users/processes/windows/files/network configuration/system time/system information, ingress tool transfer, file deletion, NTFS attribute abuse, and possible data destruction activity. Because MITRE does not provide a detection section for this malware, detection engineering should map alerts and hunts to the related techniques rather than rely on a PowerDuke-specific signature alone.
Likely telemetry
- Email gateway and attachment metadata for Microsoft Word or Excel files, especially macro-enabled documents
- Office process creation and child-process telemetry on Windows endpoints
- Command-line telemetry for cmd.exe and rundll32.exe execution
- Windows registry monitoring for Run Key changes and Startup Folder writes
- File creation, deletion, directory enumeration, and NTFS attribute or alternate data stream evidence where available
Detection direction
- Start with behavior chains: Office document opened followed by scripting, cmd.exe, rundll32.exe, discovery commands, persistence writes, or unusual file transfer activity.
- Tune rundll32 and command-shell analytics against local administrative and software-management baselines to reduce false positives without allowlisting away abuse paths.
- Hunt for clustered discovery activity on a single Windows host, especially user, process, file, network configuration, and system information enumeration occurring near suspicious Office execution.
- Validate that Registry Run Key and Startup Folder monitoring includes user-context persistence, not only administrator-level changes.
- Assess whether file deletion and NTFS attribute monitoring is sufficient for incident reconstruction, since stealth-related techniques may remove or hide artifacts.
Mitigation priorities
- Reduce macro-delivered malware risk through Office macro policy, attachment handling, and user-facing phishing controls appropriate to business workflows.
- Ensure managed detection or SOC coverage can correlate email, endpoint process, registry, file, and network evidence for Windows hosts.
- Harden and monitor common proxy-execution and shell paths such as rundll32.exe and cmd.exe without relying solely on blocklists.
- Implement persistence-control reviews for Run Keys and Startup Folders, including user-profile locations.
- Maintain tested backup and recovery processes to support resilience where destructive behavior is a concern.
Additional notes and limits
The supplied ATT&CK record identifies PowerDuke as a Windows backdoor used by APT29 in 2016 and primarily delivered through malicious Microsoft Word or Excel macros. The decision value is in validating defenses against the associated behavior set: macro initial access pattern, Windows execution, discovery, stealth, persistence, file transfer, and destructive-risk indicators.
MITRE provides no official detection text, no explicit tactics on the malware object, and no aliases or labels in the supplied fields. The external reporting reference is from 2016. Relationship descriptions describe ATT&CK techniques generally and should be validated against local telemetry before being treated as PowerDuke-specific detection logic.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
PowerDuke
No official description is available in the imported ATT&CK source object.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1016 | System Network Configuration Discovery | This object uses System Network Configuration Discovery. |
| Enterprise | T1027.003 | SteganographySub-technique | This object uses Steganography. |
| Enterprise | T1218.011 | Rundll32Sub-technique | This object uses Rundll32. |
| Enterprise | T1082 | System Information Discovery | This object uses System Information Discovery. |
| Enterprise | T1083 | File and Directory Discovery | This object uses File and Directory Discovery. |
| Enterprise | T1010 | Application Window Discovery | This object uses Application Window Discovery. |
| Enterprise | T1485 | Data Destruction | This object uses Data Destruction. |
| Enterprise | T1033 | System Owner/User Discovery | This object uses System Owner/User Discovery. |
| Enterprise | T1057 | Process Discovery | This object uses Process Discovery. |
| Enterprise | T1124 | System Time Discovery | This object uses System Time Discovery. |
| Enterprise | T1070.004 | File DeletionSub-technique | This object uses File Deletion. |
| Enterprise | T1105 | Ingress Tool Transfer | This object uses Ingress Tool Transfer. |
| Enterprise | T1564.004 | NTFS File AttributesSub-technique | This object uses NTFS File Attributes. |
| Enterprise | T1059.003 | Windows Command ShellSub-technique | This object uses Windows Command Shell. |
| Enterprise | T1547.001 | Registry Run Keys / Startup FolderSub-technique | This object uses Registry Run Keys / Startup Folder. |
Groups, software, and campaigns
G0016: APT29
APT29 is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR).[1][2] They have operated since at least 2008, often targeting government networks in Europe and NATO member countries, research institutes, and think tanks. APT29 reportedly compromised the Democratic National Committee starting in the summer of 2015.[3][4][5][6]
In April 2021, the US and UK governments attributed the SolarWinds Compromise to the SVR; public statements included citations to APT29, Cozy Bear, and The Dukes.[7][8] Industry reporting also referred to the actors involved in this campaign as UNC2452, NOBELIUM, StellarParticle, Dark Halo, and SolarStorm.[9][10][11][12][13][14]
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.2 | Current bundle | a22d1973b8f4… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]Volexity PowerDuke November 2016
Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.
Open source URL - [2]PowerDuke
(Citation: Volexity PowerDuke November 2016)
- [3]PowerDuke
(Citation: Volexity PowerDuke November 2016)
- [4]PowerDuke
(Citation: Volexity PowerDuke November 2016)
- [5]Volexity PowerDuke November 2016
Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.
Open source URL - [6]Volexity PowerDuke November 2016
Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.
Open source URL - [7]mitre-attackS0139Open source URL
- [8]mitre-attackS0139Open source URL
- [9]mitre-attackS0139Open source URL
- [10]Volexity PowerDuke November 2016
Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.
Open source URL - [11]Volexity PowerDuke November 2016
Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.
Open source URL - [12]Volexity PowerDuke November 2016
Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.
Open source URL - [13]Volexity PowerDuke November 2016
Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.
Open source URL - [14]Volexity PowerDuke November 2016
Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.
Open source URL - [15]Volexity PowerDuke November 2016
Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.
Open source URL - [16]Volexity PowerDuke November 2016
Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.
Open source URL - [17]Volexity PowerDuke November 2016
Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.
Open source URL - [18]Volexity PowerDuke November 2016
Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.
Open source URL - [19]Volexity PowerDuke November 2016
Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.
Open source URL - [20]Volexity PowerDuke November 2016
Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.
Open source URL - [21]Volexity PowerDuke November 2016
Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.
Open source URL - [22]Volexity PowerDuke November 2016
Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.
Open source URL - [23]Volexity PowerDuke November 2016
Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.
Open source URL - [24]Volexity PowerDuke November 2016
Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.
Open source URL - [25]Volexity PowerDuke November 2016
Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.
Open source URL - [26]Volexity PowerDuke November 2016
Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.
Open source URL - [27]Volexity PowerDuke November 2016
Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.
Open source URL - [28]Volexity PowerDuke November 2016
Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.
Open source URL - [29]Volexity PowerDuke November 2016
Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.
Open source URL - [30]Volexity PowerDuke November 2016
Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.
Open source URL - [31]Volexity PowerDuke November 2016
Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.
Open source URL - [32]Volexity PowerDuke November 2016
Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.
Open source URL - [33]Volexity PowerDuke November 2016
Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.
Open source URL - [34]Volexity PowerDuke November 2016
Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.
Open source URL - [35]Volexity PowerDuke November 2016
Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.
Open source URL - [36]Volexity PowerDuke November 2016
Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.
Open source URL - [37]Volexity PowerDuke November 2016
Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.
Open source URL - [38]Volexity PowerDuke November 2016
Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.
Open source URL - [39]Volexity PowerDuke November 2016
Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.
Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.