H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

PowerStallion

[PowerStallion](https://attack.mitre.org/software/S0393) is a lightweight [PowerShell](https://attack.mitre.org/techniques/T1059/001) backdoor used by [Turla](https://attack.mitre.org/groups/G0010), possibly as a recovery access tool to install other backdoors.(Citation: ESET Turla PowerShell May 2019)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[PowerStallion](https://attack.mitre.org/software/S0393) is a lightweight [PowerShell](https://attack.mitre.org/techniques/T1059/001) backdoor used by [Turla](https://attack.mitre.org/groups/G0010), possibly as a recovery access tool to install other backdoors.(Citation: ESET Turla PowerShell May 2019)

Labels

malware
6 recorded

Relationships

uses
to Bidirectional Communication
Technique
uses
to Obfuscated Files or Information
Technique
uses
to PowerShell
Technique
uses
to Process Discovery
Technique
uses
to Timestomp
Technique
uses
from Turla
Group
2 external

References

mitre-attack
S0393
open
ESET Turla PowerShell May 2019
https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance