Procedure examples

TrickBot has been known to use PowerShell to download new payloads, open documents, and upload data to command and control servers.

Bumblebee can use PowerShell for execution.

GRIFFON has used PowerShell to execute the Meterpreter downloader TinyMet.

POWRUNER is written in PowerShell.

SharpStage can execute arbitrary commands with PowerShell.

Sardonic has the ability to execute PowerShell commands on a compromised machine.

HALFBAKED can execute PowerShell scripts.

TAMECAT has used PowerShell to download and run additional content.

PS1 can utilize a PowerShell loader.

Ursnif droppers have used PowerShell in download cradles to download and execute the malware's full executable payload.

RansomHub can use PowerShell to delete volume shadow copies.

POWERSOURCE is a PowerShell backdoor.

Tsundere Botnet has been distributed via a PowerShell script.

Zeus Panda uses PowerShell to download and execute the payload.

Havoc can facilitate the execution of PowerShell commands.

Prestige can use PowerShell for payload execution on targeted systems.

InvisibleFerret has utilized a PowerShell script created in the victim’s home directory named “conf.ps1” that is used to modify configuration files for AnyDesk remote services.

StrongPity can use PowerShell to add files to the Windows Defender exclusions list.

Medusa Ransomware has launched PowerShell scripts for execution and defense evasion.

AppleSeed has the ability to execute its payload via PowerShell.

The NETWIRE binary has been executed via PowerShell script.

PyDCrypt has attempted to execute with PowerShell.

PowerExchange can use PowerShell to execute commands received from C2.

HAMMERTOSS is known to use PowerShell.

Emotet has used Powershell to retrieve the malicious payload and download additional resources like Mimikatz.

BADHATCH can utilize `powershell.exe` to execute commands on a compromised host.

PowerLess is written in and executed via PowerShell without using powershell.exe.

SystemBC has used hidden scheduled tasks to execute PowerShell commands by adding the following: `-WindowStyle Hidden -ep bypass -file `.

Gootloader can use an encoded PowerShell stager to write to the Registry for persistence.

WellMess can execute PowerShell scripts received from C2.

Woody RAT can execute PowerShell commands and scripts with the use of .NET DLL, `WoodyPowerSession`.

Mafalda can execute PowerShell commands on a compromised machine.

Squirrelwaffle has used PowerShell to execute its payload.

ShrinkLocker uses PowerShell to disable protectors used to secure the BitLocker encryption key on victim machines and then delete the key from the system.

FlawedAmmyy has used PowerShell to execute commands.

Snip3 can use a PowerShell script for second-stage execution.

RegDuke can extract and execute PowerShell scripts from C2 communications.

WhisperGate can use PowerShell to support multiple actions including execution and defense evasion.

TRANSLATEXT has used PowerShell to collect system information and to upload the collected data to a Github repository.

PowerShower is a backdoor written in PowerShell.

CHIMNEYSWEEP can invoke the PowerShell command `[Reflection.Assembly]::LoadFile(\"%s\")\n$i=\"\"\n$r=[%s]::%s(\"%s\",[ref] $i)\necho $r,$i\n` to execute secondary payloads.

FatDuke has the ability to execute PowerShell scripts.

GLASSTOKEN can use PowerShell for command execution.

PUNCHBUGGY has used PowerShell scripts.

KeyBoy uses PowerShell commands to download and execute payloads.

POSHSPY uses PowerShell to execute various commands, one to execute its payload.

DarkWatchman can execute PowerShell commands and has used PowerShell to execute a keylogger.

Lumma Stealer has used PowerShell for initial user execution and other fuctions.

SeaDuke uses a module to execute Mimikatz with PowerShell to perform Pass the Ticket.

Xbash can use scripts to invoke PowerShell to download a malicious PE executable or PE DLL for execution.