Procedure examples

DarkVishnya used PowerShell to create shellcode loaders.

RedCurl has used PowerShell to execute commands and to download malware.

Stealth Falcon malware uses PowerShell commands to perform various functions, including gathering system information via WMI and executing commands from its C2 server.

APT29 has used encoded PowerShell scripts uploaded to CozyCar installations to download and install SeaDuke.

Cinnamon Tempest has used PowerShell to communicate with C2, download files, and execute reconnaissance commands.

Chimera has used PowerShell scripts to execute malicious payloads and the DSInternals PowerShell module to make use of Active Directory features.

Medusa Group has leveraged PowerShell for execution and defense evasion. Medusa Group has also utilized PowerShell to execute a bitsadmin transfer from file hosting site.

BRONZE BUTLER has used PowerShell for execution.

Deep Panda has used PowerShell scripts to download and execute programs in memory, without writing to disk.

Ember Bear has used PowerShell commands to gather information from compromised systems, such as email servers.

LazyScripter has used PowerShell scripts to execute malicious code.

ToddyCat has used Powershell scripts to perform post exploit collection.

APT28 downloads and executes PowerShell scripts and performs PowerShell commands.

APT42 has downloaded and executed PowerShell payloads.

APT5 has used PowerShell to accomplish tasks within targeted environments.

Fox Kitten has used PowerShell scripts to access credential data.

APT-C-36 has used PowerShell in malware execution including as part of fileless attack chains to download additional payloads.

Tonto Team has used PowerShell to download additional payloads.

GOLD SOUTHFIELD has staged and executed PowerShell scripts on compromised hosts.

Lazarus Group has used PowerShell to execute commands and malicious code.

Earth Lusca has used PowerShell to execute commands.

Silence has used PowerShell to download and execute payloads.

Thrip leveraged PowerShell to run commands to download payloads, traverse the compromised networks, and carry out reconnaissance.

Cobalt Group has used powershell.exe to download and execute scripts.

CopyKittens has used PowerShell Empire.

Wizard Spider has used macros to execute PowerShell scripts to download malware on victim's machines. It has also used PowerShell to execute commands and move laterally through a victim network.

Molerats used PowerShell implants on target machines.

Inception has used PowerShell to execute malicious commands and payloads.

VOID MANTICORE has utilized PowerShell to execute malware in victim environments.

Play has used Base64-encoded PowerShell scripts to disable Microsoft Defender.

HEXANE has used PowerShell-based tools and scripts for discovery and collection on compromised hosts.

Daggerfly used PowerShell to download and execute remote-hosted files on victim systems.

WIRTE has used PowerShell for script execution.

Magic Hound has used PowerShell for execution and privilege escalation.

Threat Group-3390 has used PowerShell for execution.

APT33 has utilized PowerShell to download files from the C2 server and run various scripts.

FIN10 uses PowerShell for execution as well as PowerShell Empire to establish persistence.

FIN8's malicious spearphishing payloads are executed as PowerShell. FIN8 has also used PowerShell for lateral movement and credential access.

FIN13 has used PowerShell commands to obtain DNS data from a compromised network.

APT19 used PowerShell commands to execute payloads.

Nomadic Octopus has used PowerShell for execution.

TrickBot has been known to use PowerShell to download new payloads, open documents, and upload data to command and control servers.

Bumblebee can use PowerShell for execution.

GRIFFON has used PowerShell to execute the Meterpreter downloader TinyMet.

POWRUNER is written in PowerShell.

SharpStage can execute arbitrary commands with PowerShell.

Sardonic has the ability to execute PowerShell commands on a compromised machine.

HALFBAKED can execute PowerShell scripts.

TAMECAT has used PowerShell to download and run additional content.

PS1 can utilize a PowerShell loader.