Powercat Malware Campaign Indicators (ThreatLocker)

Daniel Jeremiah@daniyyell

•updated Mar 31, 2026•0•43

This detection identifies activity related to the ThreatLocker Powercat malware campaign, which uses fake game cheats to deliver an infostealer. The rule focuses on specific indicators observed in the campaign, including Java execution with particular command-line arguments, connections to known malicious domains (powercat.dog, ce953a0eb08246617b7f849486c4b26a7af37e9d2e8f0e13b3ae1bf0da8a70a.xyz), and specific file paths associated with the malware. A match indicates a strong reason for investigation into potential compromise, focusing on the affected host, user, and any subsequent malicious activity.