PowerSploit

S0194

About this tool

PowerSploit is an open source, offensive security framework comprised of PowerShell modules and scripts that perform a wide range of tasks related to penetration testing such as code execution, persistence, bypassing anti-virus, recon, and exfiltration.

Techniques used28

Procedure examples28

Technique	Procedure example
T1003.001 LSASS Memory	PowerSploit contains a collection of Exfiltration modules that can harvest credentials using Mimikatz. GitHub PowerSploit May 2012 PowerSploit Documentation
T1005 Data from Local System	PowerSploit contains a collection of Exfiltration modules that can access data from local files, volumes, and processes. GitHub PowerSploit May 2012 PowerSploit Documentation
T1012 Query Registry	PowerSploit contains a collection of Privesc-PowerUp modules that can query Registry keys for potential opportunities. GitHub PowerSploit May 2012 PowerSploit Documentation
T1027.005 Indicator Removal from Tools	PowerSploit's `Find-AVSignature` AntivirusBypass module can be used to locate single byte anti-virus signatures. GitHub PowerSploit May 2012 PowerSploit Documentation
T1027.010 Command Obfuscation	PowerSploit contains a collection of ScriptModification modules that compress and encode scripts and payloads. GitHub PowerSploit May 2012 PowerSploit Documentation
T1047 Windows Management Instrumentation	PowerSploit's `Invoke-WmiCommand` CodeExecution module uses WMI to execute and retrieve the output from a PowerShell payload. GitHub PowerSploit May 2012 PowerSploit Documentation
T1053.005 Scheduled Task	PowerSploit's `New-UserPersistenceOption` Persistence argument can be used to establish via a Scheduled Task/Job. GitHub PowerSploit May 2012 PowerSploit Documentation
T1055.001 Dynamic-link Library Injection	PowerSploit contains a collection of CodeExecution modules that inject code (DLL, shellcode) into a process. GitHub PowerSploit May 2012 PowerSploit Documentation
T1056.001 Keylogging	PowerSploit's `Get-Keystrokes` Exfiltration module can log keystrokes. GitHub PowerSploit May 2012 PowerSploit Documentation
T1057 Process Discovery	PowerSploit's `Get-ProcessTokenPrivilege` Privesc-PowerUp module can enumerate privileges for a given process. GitHub PowerSploit May 2012 PowerSploit Documentation
T1059.001 PowerShell	PowerSploit modules are written in and executed via PowerShell. GitHub PowerSploit May 2012 PowerSploit Documentation
T1087.001 Local Account	PowerSploit's `Get-ProcessTokenGroup` Privesc-PowerUp module can enumerate all SIDs associated with its current token. GitHub PowerSploit May 2012 PowerSploit Documentation
T1113 Screen Capture	PowerSploit's `Get-TimedScreenshot` Exfiltration module can take screenshots at regular intervals. GitHub PowerSploit May 2012 PowerSploit Documentation
T1123 Audio Capture	PowerSploit's `Get-MicrophoneAudio` Exfiltration module can record system microphone audio. GitHub PowerSploit May 2012 PowerSploit Documentation
T1134 Access Token Manipulation	PowerSploit's `Invoke-TokenManipulation` Exfiltration module can be used to manipulate tokens. GitHub PowerSploit May 2012 PowerSploit Documentation

View all 28 procedure examples

Groups that use it9

APT33 APT41 Earth Lusca FIN7 Leviathan menuPass MuddyWater Patchwork TA505

Campaigns2

CostaRicto Operation Wocao

References3

GitHub PowerSploit May 2012 Open source
PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.
PowerShellMagazine PowerSploit July 2014 Open source
Graeber, M. (2014, July 8). PowerSploit. Retrieved February 6, 2018.
PowerSploit Documentation Open source
PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.

PowerSploit

About this tool

Techniques used28

Execution7

Persistence4

Privilege Escalation6

Stealth9

Credential Access6

Discovery4

Collection4

Procedure examples28

Groups that use it9

Campaigns2

References3