The US aerospace defense industry has been targeted by a new malware known as “PowerDrop”, a PowerShell based malware script. This new malware was discovered on a US defense contractor’s network in May 2023 by Adlumin. PowerDrop is executed by Windows Management Instrumentation (WMI) using WMI event filters and consumers named “SystemPowerManager”, which itself is created by the malware using the “wmic.exe” command line application. Although WMI is typically used for legitimate users to leverage PowerShell in remote or local computers, it is also commonly used to execute PowerShell commands in an unauthorized manner. Upon activation, PowerDrop sends a message back to the designated command-and-control (C2) server and once a connection is established, an additional encrypted payload that contains PowerShell commands is uploaded to the infected machine. This backdoor allows the threat actor to execute malicious PowerShell queries as an administrator on infected devices through what are usually legitimate Windows services. Additionally, use of WMI allows PowerDrop to avoid leaving malicious files on the device’s hard drive, reducing the effectiveness of signature-based detection methods. CTIX will continue to monitor PowerDrop as it evolves and will provide updates as needed.