Procedure examples

Cuba has been dropped onto systems and used for lateral movement via obfuscated PowerShell scripts.

The Clambling dropper can use PowerShell to download the malware.

PureCrypter can execute PowerShell commands to exclude files from EDR and to self-delete.

Akira will execute PowerShell commands to delete system volume shadow copies.

DarkGate has used PowerShell to create a remote shell.

LockBit 3.0 can use PowerShell to apply Group Policy changes.

SHARPSTATS has the ability to employ a custom PowerShell script.

Ferocious can use PowerShell scripts for execution.

CreepyDrive can use Powershell for execution, including the cmdlets `Invoke-WebRequest` and `Invoke-Expression`.

Netwalker has been written in PowerShell and executed directly in memory, avoiding detection.

Saint Bot has used PowerShell for execution.

CharmPower can use PowerShell for payload execution and C2 communication.

MuddyViper has used PowerShell.exe to launch a reverse shell.

SMOKEDHAM can execute Powershell commands sent from its C2 server.

QUADAGENT uses PowerShell scripts for execution.

LP-Notes has been downloaded and executed by PowerShell’s`Invoke-WebRequest` and `Invoke-Expression` cmdlets.

Spica can use an obfuscated PowerShell command to create a scheduled task for persistence.

Bandook has used PowerShell loaders as part of execution.

KONNI used PowerShell to download and execute a specific 64-bit version of the malware.

MoleNet can use PowerShell to set persistence.

KGH_SPY can execute PowerShell commands on the victim's machine.

Black Basta has used PowerShell scripts for discovery and to execute files over the network.

RogueRobin uses a command prompt to run a PowerShell script from Excel. To assist in establishing persistence, RogueRobin creates %APPDATA%\OneDrive.bat and saves the following string to it:powershell.exe -WindowStyle Hidden -exec bypass -File “%APPDATA%\OneDrive.ps1”.

SQLRat has used PowerShell to create a Meterpreter session.

LitePower can use a PowerShell script to execute commands.

Mosquito can launch PowerShell Scripts.

StrelaStealer variants have used PowerShell scripts to download or drop payloads, including obfuscated variants to connect to a WebDAV server to download and executed an encrypted DLL for installation.

Bazar can execute a PowerShell script received from C2.

There is a variant of RATANKBA that uses a PowerShell script instead of the traditional PE form.

Pysa has used Powershell scripts to deploy its ransomware.

LockBit 2.0 can use the PowerShell module `InvokeGPUpdate` to modify Group Policy.

Cobalt Strike can execute a payload on a remote host with PowerShell. This technique does not write any data to disk. Cobalt Strike can also use PowerSploit and other scripting frameworks to perform execution.

ServHelper has the ability to execute a PowerShell script to get information from the infected host.

JCry has used PowerShell to execute payloads.

REvil has used PowerShell to delete volume shadow copies and download files.

Valak has used PowerShell to download additional modules.

OSX_OCEANLOTUS.D uses PowerShell scripts.

IPsec Helper can run arbitrary PowerShell commands passed to it.

Pillowmint has used a PowerShell script to install a shim database.

Revenge RAT uses the PowerShell command Reflection.Assembly to load itself into memory to aid in execution.

PowGoop has the ability to use PowerShell scripts to execute commands.

Lokibot has used PowerShell commands embedded inside batch scripts.

Egregor has used an encoded PowerShell command by a service created by Cobalt Strike for lateral movement.

CreepySnail can use PowerShell for execution, including the cmdlets `Invoke-WebRequst` and `Invoke-Expression`.

PowerPunch has the ability to execute through PowerShell.

BONDUPDATER is written in PowerShell.

Troll Stealer creates and executes a PowerShell script to delete itself.

Meteor can use PowerShell commands to disable the network adapters on a victim machines.

njRAT has executed PowerShell commands via auto-run registry key persistence.

ComRAT has used PowerShell to load itself every time a user logs in to the system. ComRAT can execute PowerShell scripts loaded into memory or from the file system.