Procedure examples

UNC3886 has used a PowerShell script to search memory dumps for credentials.

TA2541 has used PowerShell to download files and to inject into various Windows processes.

Akira has used PowerShell scripts for credential harvesting and privilege escalation.

OilRig has used PowerShell scripts for execution, including use of a macro to run a PowerShell command to decode file contents.

TA459 has used PowerShell for execution of a payload.

Aquatic Panda has downloaded additional scripts and executed Base64 encoded commands in PowerShell.

Saint Bear relies extensively on PowerShell execution from malicious attachments and related content to retrieve and execute follow-on payloads.

DarkHydrus leveraged PowerShell to download and execute additional scripts for execution.

Confucius has used PowerShell to execute malicious files and payloads.

Leviathan has used PowerShell for execution.

MoustachedBouncer has used plugins to execute PowerShell scripts.

Blue Mockingbird has used PowerShell reverse TCP shells to issue interactive commands over a network connection.

Winter Vivern passed execution from document macros to PowerShell scripts during initial access operations. Winter Vivern used batch scripts that called PowerShell commands as part of initial access and installation operations.

Turla has used PowerShell to execute commands/scripts, in some cases via a custom executable or code from Empire's PSInject. Turla has also used PowerShell scripts to load and execute malware in memory.

Storm-0501 has leveraged PowerShell to execute commands and scripts.

The Poseidon Group's Information Gathering Tool (IGT) includes PowerShell components.

TA505 has used PowerShell to download and execute malware and reconnaissance scripts.

DarkVishnya used PowerShell to create shellcode loaders.

RedCurl has used PowerShell to execute commands and to download malware.

Stealth Falcon malware uses PowerShell commands to perform various functions, including gathering system information via WMI and executing commands from its C2 server.

APT29 has used encoded PowerShell scripts uploaded to CozyCar installations to download and install SeaDuke.

Cinnamon Tempest has used PowerShell to communicate with C2, download files, and execute reconnaissance commands.

Chimera has used PowerShell scripts to execute malicious payloads and the DSInternals PowerShell module to make use of Active Directory features.

Medusa Group has leveraged PowerShell for execution and defense evasion. Medusa Group has also utilized PowerShell to execute a bitsadmin transfer from file hosting site.

BRONZE BUTLER has used PowerShell for execution.

Deep Panda has used PowerShell scripts to download and execute programs in memory, without writing to disk.

Ember Bear has used PowerShell commands to gather information from compromised systems, such as email servers.

LazyScripter has used PowerShell scripts to execute malicious code.

ToddyCat has used Powershell scripts to perform post exploit collection.

APT28 downloads and executes PowerShell scripts and performs PowerShell commands.

APT42 has downloaded and executed PowerShell payloads.

APT5 has used PowerShell to accomplish tasks within targeted environments.

Fox Kitten has used PowerShell scripts to access credential data.

APT-C-36 has used PowerShell in malware execution including as part of fileless attack chains to download additional payloads.

Tonto Team has used PowerShell to download additional payloads.

GOLD SOUTHFIELD has staged and executed PowerShell scripts on compromised hosts.

Lazarus Group has used PowerShell to execute commands and malicious code.

Earth Lusca has used PowerShell to execute commands.

Silence has used PowerShell to download and execute payloads.

Thrip leveraged PowerShell to run commands to download payloads, traverse the compromised networks, and carry out reconnaissance.

Cobalt Group has used powershell.exe to download and execute scripts.

CopyKittens has used PowerShell Empire.

Wizard Spider has used macros to execute PowerShell scripts to download malware on victim's machines. It has also used PowerShell to execute commands and move laterally through a victim network.

Molerats used PowerShell implants on target machines.

Inception has used PowerShell to execute malicious commands and payloads.

VOID MANTICORE has utilized PowerShell to execute malware in victim environments.

Play has used Base64-encoded PowerShell scripts to disable Microsoft Defender.

HEXANE has used PowerShell-based tools and scripts for discovery and collection on compromised hosts.

Daggerfly used PowerShell to download and execute remote-hosted files on victim systems.

WIRTE has used PowerShell for script execution.