T1059.001 PowerShell | DetectionCode

About this technique

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the Start-Process cmdlet which can be used to run an executable and the Invoke-Command cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).

PowerShell may also be used to download and run executables from the Internet, which can be executed from disk or in memory without touching disk.

A number of PowerShell-based offensive testing tools are available, including Empire, PowerSploit, PoshC2, and PSAttack.

PowerShell commands/scripts can also be executed without directly invoking the powershell.exe binary through interfaces to PowerShell's underlying System.Management.Automation assembly DLL exposed through the .NET framework and Windows Common Language Interface (CLI).

Detection rules256

Rules on DetectionCode tagged with T1059.001.

Sigma183

Rule	Level	Log source
Bad Opsec Powershell Code Artifacts	critical	windows / ps_module
Silence.EDA Detection	critical	windows / ps_script
AWS EC2 Startup Shell Script Change	high	aws / NULL
Base64 Encoded PowerShell Command Detected	high	windows / process_creation
BloodHound Collection Files	high	windows / file_event
Cmd.EXE Missing Space Characters Execution Anomaly	high	windows / process_creation
DSInternals Suspicious PowerShell Cmdlets	high	windows / process_creation
DSInternals Suspicious PowerShell Cmdlets - ScriptBlock	high	windows / ps_script
Exchange PowerShell Snap-Ins Usage	high	windows / process_creation
Execution of Powershell Script in Public Folder	high	windows / process_creation
HackTool - Bloodhound/Sharphound Execution	high	windows / process_creation
HackTool - Covenant PowerShell Launcher	high	windows / process_creation
HackTool - CrackMapExec Execution	high	windows / process_creation
HackTool - CrackMapExec Execution Patterns	high	windows / process_creation
HackTool - CrackMapExec PowerShell Obfuscation	high	windows / process_creation
HackTool - Default PowerSploit/Empire Scheduled Task Creation	high	windows / process_creation
HackTool - Empire PowerShell Launch Parameters	high	windows / process_creation
HTML Help HH.EXE Suspicious Child Process	high	windows / process_creation
Invoke-Obfuscation CLIP+ Launcher	high	windows / process_creation
Invoke-Obfuscation CLIP+ Launcher - PowerShell	high	windows / ps_script
Invoke-Obfuscation CLIP+ Launcher - PowerShell Module	high	windows / ps_module
Invoke-Obfuscation CLIP+ Launcher - Security	high	windows / NULL
Invoke-Obfuscation CLIP+ Launcher - System	high	windows / NULL
Invoke-Obfuscation Obfuscated IEX Invocation	high	windows / process_creation
Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell	high	windows / ps_script
Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell Module	high	windows / ps_module
Invoke-Obfuscation STDIN+ Launcher	high	windows / process_creation
Invoke-Obfuscation STDIN+ Launcher - Powershell	high	windows / ps_script
Invoke-Obfuscation STDIN+ Launcher - PowerShell Module	high	windows / ps_module
Invoke-Obfuscation STDIN+ Launcher - Security	high	windows / NULL
Invoke-Obfuscation STDIN+ Launcher - System	high	windows / NULL
Invoke-Obfuscation VAR+ Launcher	high	windows / process_creation
Invoke-Obfuscation VAR+ Launcher - PowerShell	high	windows / ps_script
Invoke-Obfuscation VAR+ Launcher - PowerShell Module	high	windows / ps_module
Invoke-Obfuscation VAR+ Launcher - Security	high	windows / NULL
Invoke-Obfuscation VAR+ Launcher - System	high	windows / NULL
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION	high	windows / process_creation
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell	high	windows / ps_script
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell Module	high	windows / ps_module
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - Security	high	windows / NULL
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - System	high	windows / NULL
Invoke-Obfuscation Via Stdin	high	windows / process_creation
Invoke-Obfuscation Via Stdin - Powershell	high	windows / ps_script
Invoke-Obfuscation Via Stdin - PowerShell Module	high	windows / ps_module
Invoke-Obfuscation Via Stdin - Security	high	windows / NULL
Invoke-Obfuscation Via Stdin - System	high	windows / NULL
Invoke-Obfuscation Via Use Clip	high	windows / process_creation
Invoke-Obfuscation Via Use Clip - Powershell	high	windows / ps_script
Invoke-Obfuscation Via Use Clip - PowerShell Module	high	windows / ps_module
Invoke-Obfuscation Via Use Clip - Security	high	windows / NULL
Invoke-Obfuscation Via Use Clip - System	high	windows / NULL
Invoke-Obfuscation Via Use MSHTA	high	windows / process_creation
Invoke-Obfuscation Via Use MSHTA - PowerShell	high	windows / ps_script
Invoke-Obfuscation Via Use MSHTA - PowerShell Module	high	windows / ps_module
Invoke-Obfuscation Via Use MSHTA - Security	high	windows / NULL
Invoke-Obfuscation Via Use MSHTA - System	high	windows / NULL
Invoke-Obfuscation Via Use Rundll32 - PowerShell	high	windows / ps_script
Invoke-Obfuscation Via Use Rundll32 - PowerShell Module	high	windows / ps_module
Invoke-Obfuscation Via Use Rundll32 - Security	high	windows / NULL
Invoke-Obfuscation Via Use Rundll32 - System	high	windows / NULL
Malicious Base64 Encoded PowerShell Keywords in Command Lines	high	windows / process_creation
Malicious Nishang PowerShell Commandlets	high	windows / ps_script
Malicious PowerShell Commandlets - PoshModule	high	windows / ps_module
Malicious PowerShell Commandlets - ProcessCreation	high	windows / process_creation
Malicious PowerShell Commandlets - ScriptBlock	high	windows / ps_script
Malicious PowerShell Scripts - FileCreation	high	windows / file_event
Malicious PowerShell Scripts - PoshModule	high	windows / ps_module
Malicious ShellIntel PowerShell Commandlets	high	windows / ps_script
Net WebClient Casing Anomalies	high	windows / process_creation
NTFS Alternate Data Stream	high	windows / ps_script
Obfuscated PowerShell MSI Install via WindowsInstaller COM	high	windows / process_creation
Obfuscated PowerShell OneLiner Execution	high	windows / process_creation
Potential Data Exfiltration Activity Via CommandLine Tools	high	windows / process_creation
Potential Persistence Via Powershell Search Order Hijacking - Task	high	windows / process_creation
Potential PowerShell Command Line Obfuscation	high	windows / process_creation
Potential PowerShell Obfuscation Via Reversed Commands	high	windows / process_creation
Potential PowerShell Obfuscation Via WCHAR/CHAR	high	windows / process_creation
Potential Powershell ReverseShell Connection	high	windows / process_creation
Potential Remote PowerShell Session Initiated	high	windows / network_connection
Potential WinAPI Calls Via PowerShell Scripts	high	windows / ps_script
Potentially Suspicious Command Executed Via Run Dialog Box - Registry	high	windows / registry_set
PowerShell ADRecon Execution	high	windows / ps_script
PowerShell Base64 Encoded FromBase64String Cmdlet	high	windows / process_creation
PowerShell Base64 Encoded IEX Cmdlet	high	windows / process_creation
PowerShell Base64 Encoded Invoke Keyword	high	windows / process_creation
PowerShell Base64 Encoded Reflective Assembly Load	high	windows / process_creation
PowerShell Base64 Encoded WMI Classes	high	windows / process_creation
PowerShell Called from an Executable Version Mismatch	high	windows / ps_classic_start
PowerShell Credential Prompt	high	windows / ps_script
PowerShell DownloadFile	high	windows / process_creation
PowerShell PSAttack	high	windows / ps_script
PowerShell ShellCode	high	windows / ps_script
PowerShell Web Access Installation - PsScript	high	windows / ps_script
PowerView PowerShell Cmdlets - ScriptBlock	high	windows / ps_script
PSAsyncShell - Asynchronous TCP Reverse Shell	high	windows / ps_script
Remote LSASS Process Access Through Windows Remote Management	high	windows / process_access
Remote PowerShell Session (PS Module)	high	windows / ps_module
Remote PowerShell Sessions Network Connections (WinRM)	high	windows / NULL
Scheduled Task Executing Encoded Payload from Registry	high	windows / process_creation
Suspicious Encoded And Obfuscated Reflection Assembly Load Function Call	high	windows / process_creation
Suspicious Encoded PowerShell Command Line	high	windows / process_creation
Suspicious File Execution From Internet Hosted WebDav Share	high	windows / process_creation
Suspicious HH.EXE Execution	high	windows / process_creation
Suspicious Interactive PowerShell as SYSTEM	high	windows / file_event
Suspicious PowerShell Download and Execute Pattern	high	windows / process_creation
Suspicious PowerShell Encoded Command Patterns	high	windows / process_creation
Suspicious PowerShell IEX Execution Patterns	high	windows / process_creation
Suspicious PowerShell Invocations - Generic	high	windows / ps_script
Suspicious PowerShell Invocations - Generic - PowerShell Module	high	windows / ps_module
Suspicious PowerShell Invocations - Specific	high	windows / ps_script
Suspicious PowerShell Invocations - Specific - PowerShell Module	high	windows / ps_module
Suspicious PowerShell Parameter Substring	high	windows / process_creation
Suspicious PowerShell Parent Process	high	windows / process_creation
Suspicious Schtasks Execution AppData Folder	high	windows / process_creation
Windows Shell/Scripting Processes Spawning Suspicious Programs	high	windows / process_creation
WMImplant Hack Tool	high	windows / ps_script
Alternate PowerShell Hosts - PowerShell Module	medium	windows / ps_module
Alternate PowerShell Hosts Pipe	medium	windows / pipe_created
AppLocker Application Would Have Been Blocked	medium	windows / NULL
AppLocker Prevented Application or Script from Running	medium	windows / NULL
Certificate Exported Via PowerShell	medium	windows / process_creation
Change PowerShell Policies to an Insecure Level	medium	windows / process_creation
Change PowerShell Policies to an Insecure Level - PowerShell	medium	windows / ps_script
Command Line Execution with Suspicious URL and AppData Strings	medium	windows / process_creation
ConvertTo-SecureString Cmdlet Usage Via CommandLine	medium	windows / process_creation
Detection of PowerShell Execution via Sqlps.exe	medium	windows / process_creation
Execute Code with Pester.bat	medium	windows / process_creation
Execute Code with Pester.bat as Parent	medium	windows / process_creation
Hidden Powershell in Link File Pattern	medium	windows / process_creation
Import PowerShell Modules From Suspicious Directories	medium	windows / ps_script
Import PowerShell Modules From Suspicious Directories - ProcCreation	medium	windows / process_creation
Invoke-Obfuscation COMPRESS OBFUSCATION	medium	windows / process_creation
Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell	medium	windows / ps_script
Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell Module	medium	windows / ps_module
Invoke-Obfuscation COMPRESS OBFUSCATION - Security	medium	windows / NULL
Invoke-Obfuscation COMPRESS OBFUSCATION - System	medium	windows / NULL
Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell	medium	windows / ps_script
Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell Module	medium	windows / ps_module
Invoke-Obfuscation RUNDLL LAUNCHER - Security	medium	windows / NULL
Invoke-Obfuscation RUNDLL LAUNCHER - System	medium	windows / NULL
Malicious PowerShell Keywords	medium	windows / ps_script
Netcat The Powershell Version	medium	windows / ps_classic_start
Nslookup PowerShell Download Cradle	medium	windows / ps_classic_start
Potential DLL File Download Via PowerShell Invoke-WebRequest	medium	windows / process_creation
Potential PowerShell Downgrade Attack	medium	windows / process_creation
Potential Suspicious PowerShell Keywords	medium	windows / ps_script
Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell	medium	windows / process_creation
Potentially Suspicious Powershell Script Execution From Temp Folder	medium	windows / process_creation
Potentially Suspicious WebDAV LNK Execution	medium	windows / process_creation
PowerShell Core DLL Loaded By Non PowerShell Process	medium	windows / image_load
PowerShell Create Local User	medium	windows / ps_script
PowerShell Downgrade Attack - PowerShell	medium	windows / ps_classic_start
PowerShell Download Pattern	medium	windows / process_creation
Powershell Executed From Headless ConHost Process	medium	windows / process_creation
Powershell Inline Execution From A File	medium	windows / process_creation
PowerShell MSI Install via WindowsInstaller COM From Remote Location	medium	windows / process_creation
Powershell MsXml COM Object	medium	windows / ps_script
PowerShell Remote Session Creation	medium	windows / ps_script
PowerShell Script Run in AppData	medium	windows / process_creation
PowerShell Web Download	medium	windows / process_creation
Powershell XML Execute Command	medium	windows / ps_script
Remote PowerShell Session Host Process (WinRM)	medium	windows / process_creation
Remote Thread Creation Via PowerShell In Uncommon Target	medium	windows / create_remote_thread
Scheduled Task Executing Payload from Registry	medium	windows / process_creation
SQL Client Tools PowerShell Session Detection	medium	windows / process_creation
Suspicious Execution of Powershell with Base64	medium	windows / process_creation
Suspicious Non PowerShell WSMAN COM Provider	medium	windows / NULL
Suspicious PowerShell Download - PoshModule	medium	windows / ps_module
Suspicious PowerShell Download - Powershell Script	medium	windows / ps_script
Suspicious PowerShell Invocation From Script Engines	medium	windows / process_creation
Suspicious WSMAN Provider Image Loads	medium	windows / image_load
Suspicious XOR Encoded PowerShell Command	medium	windows / process_creation
Suspicious XOR Encoded PowerShell Command Line - PowerShell	medium	windows / ps_classic_start
Usage Of Web Request Commands And Cmdlets	medium	windows / process_creation
Usage Of Web Request Commands And Cmdlets - ScriptBlock	medium	windows / ps_script
Non Interactive PowerShell Process Spawned	low	windows / process_creation
Potential Encoded PowerShell Patterns In CommandLine	low	windows / process_creation
Potential PowerShell Obfuscation Using Alias Cmdlets	low	windows / ps_script
Potential PowerShell Obfuscation Using Character Join	low	windows / ps_script
PowerShell Download Via Net.WebClient - PowerShell Classic	low	windows / ps_classic_start
Remote PowerShell Session (PS Classic)	low	windows / ps_classic_start
Renamed Powershell Under Powershell Channel	low	windows / ps_classic_start
New PowerShell Instance Created	informational	windows / pipe_created

Splunk73

Rule	Type	Risk	Data source
Any Powershell DownloadFile	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Any Powershell DownloadString	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Cisco Secure Firewall - Communication Over Suspicious Ports	Anomaly	NULL	Cisco Secure Firewall Threat Defense Connection Event
Cisco Secure Firewall - Veeam CVE-2023-27532 Exploitation Activity	TTP	NULL	Cisco Secure Firewall Threat Defense Intrusion Event
CrushFTP Authentication Bypass Exploitation	TTP	NULL	CrushFTP
Detect Certify With PowerShell Script Block Logging	TTP	NULL	Powershell Script Block Logging 4104
Detect Empire with PowerShell Script Block Logging	TTP	NULL	Powershell Script Block Logging 4104
Detect Mimikatz With PowerShell Script Block Logging	TTP	NULL	Powershell Script Block Logging 4104
Exchange PowerShell Module Usage	TTP	NULL	Powershell Script Block Logging 4104
First time seen command line argument	Hunting	NULL	Sysmon EventID 1
Get-ForestTrust with PowerShell Script Block	TTP	NULL	Powershell Script Block Logging 4104
GetLocalUser with PowerShell Script Block	Hunting	NULL	Powershell Script Block Logging 4104
GetWmiObject User Account with PowerShell Script Block	Hunting	NULL	Powershell Script Block Logging 4104
Malicious PowerShell Process - Execution Policy Bypass	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Malicious PowerShell Process With Obfuscation Techniques	TTP	NULL	Sysmon EventID 1
Nishang PowershellTCPOneLine	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Possible Lateral Movement PowerShell Spawn	Anomaly	NULL	Sysmon EventID 1, CrowdStrike ProcessRollup2
PowerShell - Connect To Internet With Hidden Window	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
PowerShell 4104 Hunting	Hunting	NULL	Powershell Script Block Logging 4104
Powershell COM Hijacking InprocServer32 Modification	TTP	NULL	Powershell Script Block Logging 4104
Powershell Creating Thread Mutex	TTP	NULL	Powershell Script Block Logging 4104
Powershell Defender Threat Actions Set to Allow	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
PowerShell Domain Enumeration	Anomaly	NULL	Powershell Script Block Logging 4104
PowerShell Enable PowerShell Remoting	Anomaly	NULL	Powershell Script Block Logging 4104
PowerShell Environment Variable Execution	Anomaly	NULL	Powershell Script Block Logging 4104
Powershell Execute COM Object	TTP	NULL	Powershell Script Block Logging 4104
Powershell Fileless Process Injection via GetProcAddress	TTP	NULL	Powershell Script Block Logging 4104
Powershell Fileless Script Contains Base64 Encoded Content	TTP	NULL	Powershell Script Block Logging 4104
Powershell Load Module in Meterpreter	TTP	NULL	Powershell Script Block Logging 4104
PowerShell Loading DotNET into Memory via Reflection	Anomaly	NULL	Powershell Script Block Logging 4104
PowerShell PInvoke Process Injection API Chain	TTP	NULL	Powershell Script Block Logging 4104
Powershell Processing Stream Of Data	Anomaly	NULL	Powershell Script Block Logging 4104
PowerShell Script Block With URL Chain	TTP	NULL	Powershell Script Block Logging 4104
PowerShell Start or Stop Service	Anomaly	NULL	Powershell Script Block Logging 4104
Powershell Using memory As Backing Store	TTP	NULL	Powershell Script Block Logging 4104
PowerShell WebRequest Using Memory Stream	TTP	NULL	Powershell Script Block Logging 4104
Recon Using WMI Class	Anomaly	NULL	Powershell Script Block Logging 4104
Set Default PowerShell Execution Policy To Unrestricted or Bypass	TTP	NULL	Sysmon EventID 13
Suspicious Powershell Command-Line Arguments	TTP	NULL	Sysmon EventID 1
Unloading AMSI via Reflection	TTP	NULL	Powershell Script Block Logging 4104
Windows Account Access Removal via Logoff Exec	Anomaly	NULL	Sysmon EventID 1
Windows Cobalt Strike PowerShell Loader	TTP	NULL	Powershell Script Block Logging 4104
Windows Content Copied from Browser was Executed	TTP	NULL	Sysmon EventID 13 AND Sysmon EventID 24
Windows Crowdstrike RTR Script Execution	Anomaly	NULL	Sysmon EventID 1, CrowdStrike ProcessRollup2
Windows Default Cobalt Strike PowerShell Beacon	TTP	NULL	Powershell Script Block Logging 4104
Windows Enable PowerShell Web Access	TTP	NULL	Powershell Script Block Logging 4104
Windows Explorer LNK Exploit Process Launch With Padding	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688
Windows Explorer.exe Spawning PowerShell or Cmd	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688
Windows File Download Via PowerShell	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2, Cisco Network Visibility Module Flow Data
Windows MSExchange Management Mailbox Cmdlet Usage	Anomaly	NULL
Windows Powershell Commands from DNS TXT	Anomaly	NULL	Powershell Script Block Logging 4104
Windows Powershell Cryptography Namespace	Anomaly	NULL	Powershell Script Block Logging 4104
Windows PowerShell FakeCAPTCHA Clipboard Execution	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2, Cisco Network Visibility Module Flow Data
Windows PowerShell Get CIMInstance Remote Computer	Anomaly	NULL	Powershell Script Block Logging 4104
Windows Powershell Import Applocker Policy	Anomaly	NULL	Powershell Script Block Logging 4104
Windows PowerShell Invoke-RestMethod IP Information Collection	Anomaly	NULL	Powershell Script Block Logging 4104
Windows PowerShell Invoke-Sqlcmd Execution	Hunting	NULL	Powershell Script Block Logging 4104
Windows Powershell Logoff User via Quser	Anomaly	NULL	Powershell Script Block Logging 4104
Windows PowerShell Module File Created	Anomaly	NULL	Sysmon EventID 11
Windows PowerShell MSIX Package Installation	TTP	NULL	Powershell Script Block Logging 4104
Windows PowerShell Process Implementing Manual Base64 Decoder	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows PowerShell Process With Malicious String	TTP	NULL	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2
Windows Powershell RemoteSigned File	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows PowerShell ScheduleTask	Anomaly	NULL	Powershell Script Block Logging 4104
Windows PowerShell Script Block With Malicious String	TTP	NULL	Powershell Script Block Logging 4104
Windows PowerShell Script From WindowsApps Directory	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows PowerShell Script TabExpansion Direct Call	Anomaly	NULL	Powershell Script Block Logging 4104
Windows PowerShell WMI Win32 ScheduledJob	TTP	NULL	Powershell Script Block Logging 4104
Windows PowGoop Beacon Decoding	TTP	NULL	Sysmon EventID 1, CrowdStrike ProcessRollup2
Windows Shell Process from CrushFTP	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows Software Discovery Via PowerShell	Anomaly	NULL	Powershell Script Block Logging 4104
Windows SSH Proxy Command	Anomaly	NULL	Sysmon EventID 1, CrowdStrike ProcessRollup2
Windows Suspicious React or Next.js Child Process	TTP	NULL	Sysmon EventID 1, CrowdStrike ProcessRollup2

Groups85

Show 61 more

Software131

Show 107 more

Denis Donut DownPaper Egregor Emotet Empire FatDuke Ferocious FlawedAmmyy GLASSTOKEN Gootloader GRIFFON HALFBAKED HAMMERTOSS Hancitor Havoc Helminth InvisibleFerret IPsec Helper JCry JSS Loader KeyBoy KGH_SPY Koadic KOCTOPUS KONNI LazyWiper LitePower Lizar LockBit 2.0 LockBit 3.0 Lokibot LP-Notes Lumma Stealer LunarWeb Mafalda Medusa Ransomware Meteor MoleNet Mosquito MuddyViper Netwalker NETWIRE njRAT OSX_OCEANLOTUS.D Pillowmint POSHSPY PowerExchange PowerLess PowerPunch PowerShower POWERSOURCE PowerSploit PowerStallion POWERSTATS POWERTON PowGoop POWRUNER Prestige PS1 PUNCHBUGGY Pupy PureCrypter PyDCrypt Pysa QakBot Qilin QUADAGENT RansomHub RATANKBA RegDuke Revenge RAT REvil RogueRobin Saint Bot Sardonic SeaDuke ServHelper Shai-Hulud SharpStage SHARPSTATS ShrinkLocker SILENTTRINITY Sliver SMOKEDHAM Snip3 Socksbot Spica SQLRat Squirrelwaffle StrelaStealer StrongPity SystemBC TAMECAT TRANSLATEXT TrickBot Troll Stealer Tsundere Botnet Ursnif Valak WarzoneRAT WellMess WhisperGate Woody RAT Xbash ZeroCleare Zeus Panda

Campaigns17

2016 Ukraine Electric Power Attack 2022 Ukraine Electric Power Attack APT28 Nearest Neighbor Campaign C0018 C0021 C0032 Frankenstein HomeLand Justice Juicy Mix Operation AkaiRyū Operation Dream Job Operation Wocao Pikabot Distribution February 2024 RedDelta Modified PlugX Infection Chain Operations SharePoint ToolShell Exploitation SolarWinds Compromise Triton Safety Instrumented System Attack

Procedure examples233

Groups85

Used by	Procedure example
GroupAkira	Akira has used PowerShell scripts for credential harvesting and privilege escalation. Cisco Akira Ransomware OCT 2024
GroupAPT-C-36	APT-C-36 has used PowerShell in malware execution including as part of fileless attack chains to download additional payloads. Kaspersky BlindEagle AUG 2024 Zscaler BlindEagle DEC 2025
GroupAPT19	APT19 used PowerShell commands to execute payloads. FireEye APT19
GroupAPT28	APT28 downloads and executes PowerShell scripts and performs PowerShell commands. Cybersecurity Advisory GRU Brute Force Campaign July 2021 Palo Alto Sofacy 06-2018 TrendMicro Pawn Storm Dec 2020
GroupAPT29	APT29 has used encoded PowerShell scripts uploaded to CozyCar installations to download and install SeaDuke. ESET T3 Threat Report 2021 Mandiant No Easy Breach Secureworks IRON HEMLOCK Profile Symantec Seaduke 2015
GroupAPT3	APT3 has used PowerShell on victim systems to download and run payloads after exploitation. FireEye Operation Double Tap
GroupAPT32	APT32 has used PowerShell-based tools, PowerShell one-liners, and shellcode loaders for execution. Cybereason Cobalt Kitty 2017 Cybereason Oceanlotus May 2017 FireEye APT32 May 2017
GroupAPT33	APT33 has utilized PowerShell to download files from the C2 server and run various scripts. Microsoft Holmium June 2020 Symantec Elfin Mar 2019

View all 85 groups examples

Software131

Used by	Procedure example
ToolAADInternals	AADInternals is written and executed via PowerShell. AADInternals Documentation
MalwareAkira	Akira will execute PowerShell commands to delete system volume shadow copies. CISA Akira Ransomware APR 2024 Kersten Akira 2023
MalwareAppleSeed	AppleSeed has the ability to execute its payload via PowerShell. Malwarebytes Kimsuky June 2021
MalwareAutoIt backdoor	AutoIt backdoor downloads a PowerShell script that decodes to a typical shellcode loader. Forcepoint Monsoon
MalwareBADHATCH	BADHATCH can utilize `powershell.exe` to execute commands on a compromised host. BitDefender BADHATCH Mar 2021 Gigamon BADHATCH Jul 2019
MalwareBandook	Bandook has used PowerShell loaders as part of execution. CheckPoint Bandook Nov 2020
MalwareBazar	Bazar can execute a PowerShell script received from C2. CrowdStrike Wizard Spider October 2020 NCC Group Team9 June 2020
MalwareBlack Basta	Black Basta has used PowerShell scripts for discovery and to execute files over the network. NCC Group Black Basta June 2022 Trend Micro Black Basta May 2022 Trend Micro Black Basta Spotlight September 2022

View all 131 software examples

Campaigns17

Used by	Procedure example
Campaign2016 Ukraine Electric Power Attack	During the 2016 Ukraine Electric Power Attack, Sandworm Team used PowerShell scripts to run a credential harvesting tool in memory to evade defenses. Dragos Crashoverride 2018
Campaign2022 Ukraine Electric Power Attack	During the 2022 Ukraine Electric Power Attack, Sandworm Team utilized a PowerShell utility called TANKTRAP to spread and launch a wiper using Windows Group Policy. Mandiant-Sandworm-Ukraine-2022
CampaignAPT28 Nearest Neighbor Campaign	During APT28 Nearest Neighbor Campaign, APT28 used PowerShell cmdlet `Get-ChildItem` to access credentials, among other PowerShell functions deployed. Nearest Neighbor Volexity
CampaignC0018	During C0018, the threat actors used encoded PowerShell scripts for execution. Cisco Talos Avos Jun 2022 Costa AvosLocker May 2022
CampaignC0021	During C0021, the threat actors used obfuscated PowerShell to extract an encoded payload from within an .LNK file. FireEye APT29 Nov 2018 Microsoft Unidentified Dec 2018
CampaignC0032	During the C0032 campaign, TEMP.Veles used PowerShell to perform timestomping. FireEye TRITON 2019
CampaignFrankenstein	During Frankenstein, the threat actors used PowerShell to run a series of Base64-encoded commands that acted as a stager and enumerated hosts. Talos Frankenstein June 2019
CampaignHomeLand Justice	During HomeLand Justice, threat actors used PowerShell cmdlets New-MailboxSearch and Get-Recipient for discovery. CISA Iran Albanian Attacks September 2022 Microsoft Albanian Government Attacks September 2022

View all 17 campaigns examples

References5

Github PSAttack Open source
Haight, J. (2016, April 21). PS>Attack. Retrieved September 27, 2024.
Microsoft PSfromCsharp APR 2014 Open source
Babinec, K. (2014, April 28). Executing PowerShell scripts from C#. Retrieved April 22, 2019.
SilentBreak Offensive PS Dec 2015 Open source
Christensen, L.. (2015, December 28). The Evolution of Offensive PowerShell Invocation. Retrieved December 8, 2018.
Sixdub PowerPick Jan 2016 Open source
Warner, J.. (2015, January 6). Inexorable PowerShell – A Red Teamer’s Tale of Overcoming Simple AppLocker Policies. Retrieved December 8, 2018.
TechNet PowerShell Open source
Microsoft. (n.d.). Windows PowerShell Scripting. Retrieved April 28, 2016.