Living-off-the-Land attack: PowerDrop

Adlumin researchers uncovered ‘PowerDrop’, a living‑off‑the‑land PowerShell RAT targeting the U.S. aerospace/defense sector that uses WMI event filters for remote execution, ICMP-based heartbeat (120s interval), and single-command PowerShell launches (no persistent PS1) to stealthily map networks and exfiltrate host and network details to a C2 server; recommended mitigations include application containment, ringfencing, and Zero Trust controls to prevent PowerShell from calling out.