Powercat Malware Campaign Indicators

Daniel Jeremiah@daniyyell

•updated Mar 31, 2026•1•0•56

This rule detects activity associated with the Powercat malware campaign by looking for specific domains in process command lines, network connections, or unique strings like "jd-gui.jar" and "\Xeno\workspace" in process command lines. The detection focuses on high-confidence indicators observed in reporting to identify potential infostealer activity.