Turla__2019__A_dive_into_Turla_PowerShell_usage.pdf

Threat intelligence detailing Turla's multi-component intrusion toolkit, including PowerShell loaders with in-memory execution, WMI persistence, AMSI bypass, RPC backdoors, and PowerStallion using OneDrive for C2, supported by indicators of compromise and MITRE ATT&CK mapping.