Procedure examples

LunarWeb has the ability to run shell commands via PowerShell.

Qilin has been deployed on VMware vCenter and ESXi servers via custom PowerShell script. Qilin has also used PowerShell for discovery in vCenter and Active Directory environments.

LazyWiper has used PowerShell to enable data destruction on targeted systems.

DownPaper uses PowerShell for execution.

Socksbot can write and execute PowerShell scripts.

POWERSTATS uses PowerShell for obfuscation and execution.

POWERTON is written in PowerShell.

QakBot can use PowerShell to download and execute payloads.

Hancitor has used PowerShell to execute commands.

One version of Helminth uses a PowerShell script.

Denis has a version written in PowerShell.

AutoIt backdoor downloads a PowerShell script that decodes to a typical shellcode loader.

JSS Loader has the ability to download and execute PowerShell scripts.

Lizar has used PowerShell scripts.

WarzoneRAT can use PowerShell to download files and execute commands.

Covenant can create PowerShell-based launchers for Grunt installation.

BloodHound can use PowerShell to pull Active Directory information from the target environment.

Sliver has built-in functionality to launch a Powershell command prompt.

SILENTTRINITY can use PowerShell to execute commands.

PowerSploit modules are written in and executed via PowerShell.

AADInternals is written and executed via PowerShell.

Empire leverages PowerShell for the majority of its client-side agent tasks. Empire also contains the ability to conduct PowerShell remoting with the Invoke-PSRemoting module.

ConnectWise can be used to execute PowerShell commands on target machines.

Donut can generate shellcode outputs that execute via PowerShell.

CrackMapExec can execute PowerShell commands via WMI.

Koadic has used PowerShell to establish persistence.

Pupy has a module for loading and executing PowerShell scripts.

ZeroCleare can use a malicious PowerShell script to bypass Windows controls.

macOS.OSAMiner has used `osascript` to call itself via the `do shell script` command in the Launch Agent `.plist` file.

Cuckoo Stealer can use osascript to generate a password-stealing prompt, duplicate files and folders, and set environmental variables.

ThiefQuest uses AppleScript's osascript -e command to launch ThiefQuest's persistence via Launch Agent and Launch Daemon.

Bundlore can use AppleScript to inject malicious JavaScript into a browser.

GlassWorm has utilized AppleScript to include `set keychainPassword to do shell script` to execute shell command that retrieves passwords from the macOS keychain.

Dok uses AppleScript to create a login item for persistence.

TrickBot has used macros in Excel documents to download and deploy the malware on the user’s machine.

PowerDuke runs cmd.exe /c and sends the output to its C2.

BLINDINGCAN has executed commands via cmd.exe.

Pikabot can execute Windows shell commands via cmd.exe.

Wiarp creates a backdoor through which remote attackers can open a command line interface.

RCSession can use `cmd.exe` for execution on compromised hosts.

Spark can use cmd.exe to run commands.

Bumblebee can use `cmd.exe` to drop and run files.

MURKYTOP uses the command-line interface.

Exaramel for Windows has a command to launch a remote shell and executes commands on the victim’s machine.

Proxysvc executes a binary on the system and logs the results into a temp file by using: cmd.exe /c "<file_path> > %temp%\PM* .tmp 2>&1".

Orz can execute shell commands. Orz can execute commands with JavaScript.

IronWind has used the Windows command shell to execute malicious files.

SEASHARPEE can execute commands on victims.

POWRUNER can execute commands from its C2 server.

RobbinHood uses cmd.exe on the victim's computer.