UAC-0001 APT28 Macro Execution Leading to PowerShell

Aaron Mog@AaronMogS2S

•updated Jun 24, 2025•5•9•82

Detects the execution of PowerShell by a Microsoft Office application. This behavior is consistent with the UAC-0001 (APT28) campaign described by CERT-UA, where a malicious document's macro was used to launch PowerShell for installing the BEARDSHELL backdoor and COVENANT C2 framework components.