Threat intelligence / Technique

PowerShell

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.(Citation: TechNet PowerShell) Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the Start-Process cmdlet which can be used to run an executable and the Invoke-Command cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems). PowerShell may also be used to download and run executables from the Internet, which can be executed from disk or in memory without touching disk. A number of PowerShell-based offensive testing tools are available, including [Empire](https://attack.mitre.org/software/S0363), [PowerSploit](https://attack.mitre.org/software/S0194), [PoshC2](https://attack.mitre.org/software/S0378), and PSAttack.(Citation: Github PSAttack) PowerShell commands/scripts can also be executed without directly invoking the powershell.exe binary through interfaces to PowerShell's underlying System.Management.Automation assembly DLL exposed through the .NET framework and Windows Common Language Interface (CLI).(Citation: Sixdub PowerPick Jan 2016)(Citation: SilentBreak Offensive PS Dec 2015)(Citation: Microsoft PSfromCsharp APR 2014)

Technique

TypeTechnique

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

240 recorded

Relationships

mitigates

from Antivirus/Antimalware

Mitigation

mitigates

from Code Signing

Mitigation

mitigates

from Disable or Remove Feature or Program

Mitigation

mitigates

from Execution Prevention

Mitigation

mitigates

from Privileged Account Management

Mitigation

revoked-by

from PowerShell

Technique

subtechnique-of

to Command and Scripting Interpreter

Technique

uses

from 2016 Ukraine Electric Power Attack

Campaign

uses

from 2022 Ukraine Electric Power Attack

Campaign

uses

from AADInternals

Tool

uses

from Akira

Malware

uses

from Akira

Group

uses

from AppleSeed

Malware

uses

from APT19

Group

uses

from APT28

Group

uses

from APT28 Nearest Neighbor Campaign

Campaign

uses

from APT29

Group

uses

from APT3

Group

uses

from APT32

Group

uses

from APT33

Group

uses

from APT38

Group

uses

from APT39

Group

uses

from APT41

Group

uses

from APT42

Group

uses

from APT5

Group

uses

from APT-C-36

Group

uses

from Aquatic Panda

Group

uses

from AutoIt backdoor

Malware

uses

from BADHATCH

Malware

uses

from Bandook

Malware

uses

from Bazar

Malware

uses

from Black Basta

Malware

uses

from BlackByte

Group

uses

from BloodHound

Tool

uses

from Blue Mockingbird

Group

uses

from BONDUPDATER

Malware

uses

from BRONZE BUTLER

Group

uses

from Bumblebee

Malware

uses

from C0018

Campaign

uses

from C0021

Campaign

uses

from C0032

Campaign

uses

from CharmPower

Malware

uses

from Chimera

Group

uses

from CHIMNEYSWEEP

Malware

uses

from Cinnamon Tempest

Group

uses

from Clambling

Malware

uses

from Cobalt Group

Group

uses

from Cobalt Strike

Malware

uses

from ComRAT

Malware

uses

from Confucius

Group

uses

from ConnectWise

Tool

uses

from CopyKittens

Group

uses

from Covenant

Tool

uses

from CrackMapExec

Tool

uses

from CreepyDrive

Malware

uses

from CreepySnail

Malware

uses

from Cuba

Malware

uses

from CURIUM

Group

uses

from Daggerfly

Group

uses

from DarkGate

Malware

uses

from DarkHydrus

Group

uses

from DarkVishnya

Group

uses

from DarkWatchman

Malware

uses

from Deep Panda

Group

uses

from Denis

Malware

uses

from Donut

Tool

uses

from DownPaper

Malware

uses

from Dragonfly

Group

uses

from Earth Lusca

Group

uses

from Egregor

Malware

uses

from Ember Bear

Group

uses

from Emotet

Malware

uses

from Empire

Tool

uses

from FatDuke

Malware

uses

from Ferocious

Malware

uses

from FIN10

Group

uses

from FIN13

Group

uses

from FIN6

Group

uses

from FIN7

Group

uses

from FIN8

Group

uses

from FlawedAmmyy

Malware

uses

from Fox Kitten

Group

uses

from Frankenstein

Campaign

uses

from GALLIUM

Group

uses

from Gallmaker

Group

uses

from Gamaredon Group

Group

uses

from GLASSTOKEN

Malware

uses

from GOLD SOUTHFIELD

Group

uses

from Gootloader

Malware

uses

from Gorgon Group

Group

uses

from GRIFFON

Malware

uses

from HAFNIUM

Group

uses

from HALFBAKED

Malware

uses

from HAMMERTOSS

Malware

uses

from Hancitor

Malware

uses

from Havoc

Malware

uses

from Helminth

Malware

uses

from HEXANE

Group

uses

from HomeLand Justice

Campaign

uses

from Inception

Group

uses

from Indrik Spider

Group

uses

from InvisibleFerret

Malware

uses

from IPsec Helper

Malware

uses

from JCry

Malware

uses

from JSS Loader

Malware

uses

from Juicy Mix

Campaign

uses

from KeyBoy

Malware

uses

from KGH_SPY

Malware

uses

from Kimsuky

Group

uses

from Koadic

Tool

uses

from KOCTOPUS

Malware

uses

from KONNI

Malware

uses

from Lazarus Group

Group

uses

from LazyScripter

Group

uses

from LazyWiper

Malware

uses

from Leviathan

Group

uses

from LitePower

Malware

uses

from Lizar

Malware

uses

from LockBit 2.0

Malware

uses

from LockBit 3.0

Malware

uses

from Lokibot

Malware

uses

from LP-Notes

Malware

uses

from Lumma Stealer

Malware

uses

from LunarWeb

Malware

uses

from Mafalda

Malware

uses

from Magic Hound

Group

uses

from Medusa Group

Group

uses

from Medusa Ransomware

Malware

uses

from menuPass

Group

uses

from Meteor

Malware

uses

from MoleNet

Malware

uses

from Molerats

Group

uses

from Mosquito

Malware

uses

from MoustachedBouncer

Group

uses

from MuddyViper

Malware

uses

from MuddyWater

Group

uses

from Mustang Panda

Group

uses

from Netwalker

Malware

uses

from NETWIRE

Malware

uses

from njRAT

Malware

uses

from Nomadic Octopus

Group

uses

from OilRig

Group

uses

from Operation AkaiRyū

Campaign

uses

from Operation Dream Job

Campaign

uses

from Operation Wocao

Campaign

uses

from OSX_OCEANLOTUS.D

Malware

uses

from Patchwork

Group

uses

from Pikabot Distribution February 2024

Campaign

uses

from Pillowmint

Malware

uses

from Play

Group

uses

from Poseidon Group

Group

uses

from POSHSPY

Malware

uses

from PowerExchange

Malware

uses

from PowerLess

Malware

uses

from PowerPunch

Malware

uses

from PowerShower

Malware

uses

from POWERSOURCE

Malware

uses

from PowerSploit

Tool

uses

from PowerStallion

Malware

uses

from POWERSTATS

Malware

uses

from POWERTON

Malware

uses

from PowGoop

Malware

uses

from POWRUNER

Malware

uses

from Prestige

Malware

uses

from PS1

Malware

uses

from PUNCHBUGGY

Malware

uses

from Pupy

Tool

uses

from PureCrypter

Malware

uses

from PyDCrypt

Malware

uses

from Pysa

Malware

uses

from QakBot

Malware

uses

from Qilin

Malware

uses

from QUADAGENT

Malware

uses

from RansomHub

Malware

uses

from RATANKBA

Malware

uses

from RedCurl

Group

uses

from RedDelta Modified PlugX Infection Chain Operations

Campaign

uses

from RegDuke

Malware

uses

from Revenge RAT

Malware

uses

from REvil

Malware

uses

from RogueRobin

Malware

uses

from Saint Bear

Group

uses

from Saint Bot

Malware

uses

from Sandworm Team

Group

uses

from Sardonic

Malware

uses

from Scattered Spider

Group

uses

from SeaDuke

Malware

uses

from ServHelper

Malware

uses

from Shai-Hulud

Malware

uses

from SharePoint ToolShell Exploitation

Campaign

uses

from SharpStage

Malware

uses

from SHARPSTATS

Malware

uses

from ShrinkLocker

Malware

uses

from Sidewinder

Group

uses

from Silence

Group

uses

from SILENTTRINITY

Tool

uses

from Sliver

Tool

uses

from SMOKEDHAM

Malware

uses

from Snip3

Malware

uses

from Socksbot

Malware

uses

from SolarWinds Compromise

Campaign

uses

from Spica

Malware

uses

from SQLRat

Malware

uses

from Squirrelwaffle

Malware

uses

from Stealth Falcon

Group

uses

from Storm-0501

Group

uses

from Storm-1811

Group

uses

from StrelaStealer

Malware

uses

from StrongPity

Malware

uses

from SystemBC

Malware

uses

from TA2541

Group

uses

from TA459

Group

uses

from TA505

Group

uses

from TAMECAT

Malware

uses

from TeamTNT

Group

uses

from Threat Group-3390

Group

uses

from Thrip

Group

uses

from ToddyCat

Group

uses

from Tonto Team

Group

uses

from TRANSLATEXT

Malware

uses

from TrickBot

Malware

uses

from Triton Safety Instrumented System Attack

Campaign

uses

from Troll Stealer

Malware

uses

from Tsundere Botnet

Malware

uses

from Turla

Group

uses

from UNC3886

Group

uses

from Ursnif

Malware

uses

from Valak

Malware

uses

from VOID MANTICORE

Group

uses

from Volt Typhoon

Group

uses

from WarzoneRAT

Malware

uses

from WellMess

Malware

uses

from WhisperGate

Malware

uses

from Winter Vivern

Group

uses

from WIRTE

Group

uses

from Wizard Spider

Group

uses

from Woody RAT

Malware

uses

from Xbash

Malware

uses

from ZeroCleare

Malware

uses

from Zeus Panda

Malware

9 external

References

mitre-attack

T1059.001

open

Microsoft PSfromCsharp APR 2014

https://blogs.msdn.microsoft.com/kebab/2014/04/28/executing-powershell-scripts-from-c/

open

SilentBreak Offensive PS Dec 2015

https://web.archive.org/web/20190508170150/https://silentbreaksecurity.com/powershell-jobs-without-powershell-exe/

open

FireEye PowerShell Logging 2016

https://www.fireeye.com/blog/threat-research/2016/02/greater_visibilityt.html

open

Github PSAttack

https://github.com/Exploit-install/PSAttack-1

open

inv_ps_attacks

https://powershellmagazine.com/2014/07/16/investigating-powershell-attacks/

open

Malware Archaeology PowerShell Cheat Sheet

http://www.malwarearchaeology.com/s/Windows-PowerShell-Logging-Cheat-Sheet-ver-June-2016-v2.pdf

open

TechNet PowerShell

https://technet.microsoft.com/en-us/scriptcenter/dd742419.aspx

open

Sixdub PowerPick Jan 2016

https://web.archive.org/web/20160327101330/http://www.sixdub.net/?p=367

open