Procedure examples

Medusa Group has leveraged PowerShell for execution and defense evasion. Medusa Group has also utilized PowerShell to execute a bitsadmin transfer from file hosting site.

BRONZE BUTLER has used PowerShell for execution.

Deep Panda has used PowerShell scripts to download and execute programs in memory, without writing to disk.

Ember Bear has used PowerShell commands to gather information from compromised systems, such as email servers.

LazyScripter has used PowerShell scripts to execute malicious code.

ToddyCat has used Powershell scripts to perform post exploit collection.

APT28 downloads and executes PowerShell scripts and performs PowerShell commands.

APT42 has downloaded and executed PowerShell payloads.

APT5 has used PowerShell to accomplish tasks within targeted environments.

Fox Kitten has used PowerShell scripts to access credential data.

APT-C-36 has used PowerShell in malware execution including as part of fileless attack chains to download additional payloads.

Tonto Team has used PowerShell to download additional payloads.

GOLD SOUTHFIELD has staged and executed PowerShell scripts on compromised hosts.

Lazarus Group has used PowerShell to execute commands and malicious code.

Earth Lusca has used PowerShell to execute commands.

Silence has used PowerShell to download and execute payloads.

Thrip leveraged PowerShell to run commands to download payloads, traverse the compromised networks, and carry out reconnaissance.

Cobalt Group has used powershell.exe to download and execute scripts.

CopyKittens has used PowerShell Empire.

Wizard Spider has used macros to execute PowerShell scripts to download malware on victim's machines. It has also used PowerShell to execute commands and move laterally through a victim network.

Molerats used PowerShell implants on target machines.

Inception has used PowerShell to execute malicious commands and payloads.

VOID MANTICORE has utilized PowerShell to execute malware in victim environments.

Play has used Base64-encoded PowerShell scripts to disable Microsoft Defender.

HEXANE has used PowerShell-based tools and scripts for discovery and collection on compromised hosts.

Daggerfly used PowerShell to download and execute remote-hosted files on victim systems.

WIRTE has used PowerShell for script execution.

Magic Hound has used PowerShell for execution and privilege escalation.

Threat Group-3390 has used PowerShell for execution.

APT33 has utilized PowerShell to download files from the C2 server and run various scripts.

FIN10 uses PowerShell for execution as well as PowerShell Empire to establish persistence.

FIN8's malicious spearphishing payloads are executed as PowerShell. FIN8 has also used PowerShell for lateral movement and credential access.

FIN13 has used PowerShell commands to obtain DNS data from a compromised network.

APT19 used PowerShell commands to execute payloads.

Nomadic Octopus has used PowerShell for execution.