Procedure examples

PowerStallion uses PowerShell loops to iteratively check for available commands in its OneDrive C2 server.

Shai-Hulud has utilized PowerShell `Invoke-WebRequest` to download and install the malicious payload.

KOCTOPUS has used PowerShell commands to download additional files.

LunarWeb has the ability to run shell commands via PowerShell.

Qilin has been deployed on VMware vCenter and ESXi servers via custom PowerShell script. Qilin has also used PowerShell for discovery in vCenter and Active Directory environments.

LazyWiper has used PowerShell to enable data destruction on targeted systems.

DownPaper uses PowerShell for execution.

Socksbot can write and execute PowerShell scripts.

POWERSTATS uses PowerShell for obfuscation and execution.

POWERTON is written in PowerShell.

QakBot can use PowerShell to download and execute payloads.

Hancitor has used PowerShell to execute commands.

One version of Helminth uses a PowerShell script.

Denis has a version written in PowerShell.

AutoIt backdoor downloads a PowerShell script that decodes to a typical shellcode loader.

JSS Loader has the ability to download and execute PowerShell scripts.

Lizar has used PowerShell scripts.

WarzoneRAT can use PowerShell to download files and execute commands.

Covenant can create PowerShell-based launchers for Grunt installation.

BloodHound can use PowerShell to pull Active Directory information from the target environment.

Sliver has built-in functionality to launch a Powershell command prompt.

SILENTTRINITY can use PowerShell to execute commands.

PowerSploit modules are written in and executed via PowerShell.

AADInternals is written and executed via PowerShell.

Empire leverages PowerShell for the majority of its client-side agent tasks. Empire also contains the ability to conduct PowerShell remoting with the Invoke-PSRemoting module.

ConnectWise can be used to execute PowerShell commands on target machines.

Donut can generate shellcode outputs that execute via PowerShell.

CrackMapExec can execute PowerShell commands via WMI.

Koadic has used PowerShell to establish persistence.

Pupy has a module for loading and executing PowerShell scripts.

ZeroCleare can use a malicious PowerShell script to bypass Windows controls.