Threat intelligence / Tool

PoshC2

[PoshC2](https://attack.mitre.org/software/S0378) is an open source remote administration and post-exploitation framework that is publicly available on GitHub. The server-side components of the tool are primarily written in Python, while the implants are written in [PowerShell](https://attack.mitre.org/techniques/T1059/001). Although [PoshC2](https://attack.mitre.org/software/S0378) is primarily focused on Windows implantation, it does contain a basic Python dropper for Linux/macOS.(Citation: GitHub PoshC2)

Tool

TypeTool

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[PoshC2](https://attack.mitre.org/software/S0378) is an open source remote administration and post-exploitation framework that is publicly available on GitHub. The server-side components of the tool are primarily written in Python, while the implants are written in [PowerShell](https://attack.mitre.org/techniques/T1059/001). Although [PoshC2](https://attack.mitre.org/software/S0378) is primarily focused on Windows implantation, it does contain a basic Python dropper for Linux/macOS.(Citation: GitHub PoshC2)

Labels

tool

35 recorded

Relationships

uses

from APT33

Group

uses

Group

uses

to Access Token Manipulation

Technique

uses

to Archive via Utility

Technique

uses

to Automated Collection

Technique

uses

Technique

uses

to Bypass User Account Control

Technique

uses

to Create Process with Token

Technique

uses

to Credentials from Password Stores

Technique

uses

to Credentials In Files

Technique

uses

to Domain Account

Technique

uses

to Domain Trust Discovery

Technique

uses

to Exploitation for Privilege Escalation

Technique

uses

to Exploitation of Remote Services

Technique

uses

to File and Directory Discovery

Technique

uses

Technique

uses

to Local Account

Technique

uses

to Local Groups

Technique

uses

to LSASS Memory

Technique

uses

to Name Resolution Poisoning and SMB Relay

Technique

uses

to Network Service Discovery

Technique

uses

to Network Sniffing

Technique

uses

to Pass the Hash

Technique

uses

to Password Policy Discovery

Technique

uses

to Process Injection

Technique

uses

Technique

uses

to Service Execution

Technique

uses

to System Information Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Network Connections Discovery

Technique

uses

to System Service Discovery

Technique

uses

to Web Protocols

Technique

uses

to Windows Management Instrumentation

Technique

uses

to Windows Management Instrumentation Event Subscription

Technique

uses

from Sandworm Team

Group

2 external

References

mitre-attack

S0378

GitHub PoshC2

https://github.com/nettitude/PoshC2_Python