Procedure examples

APT38 has used PowerShell to execute commands and other operational tasks.

Indrik Spider has used PowerShell Empire for execution of malware.

BlackByte used encoded PowerShell commands during operations. BlackByte has used remote PowerShell commands in victim networks.

GALLIUM used PowerShell for execution to assist in lateral movement as well as for dumping credentials stored on compromised machines.

APT3 has used PowerShell on victim systems to download and run payloads after exploitation.

Kimsuky has executed a variety of PowerShell scripts including Invoke-Mimikatz. Kimsuky has also utilized PowerShell scripts for execution, persistence, and defense evasion. Kimsuky has leveraged PowerShell’s cmdlet `Expand-Archive` to extract contents of zip files into the same directory. Kimsuky has employed ClickFix type tactics enticing victims to copy and paste malicious PowerShell commands and scripts, where the scripts ultimately led to QuasarRAT.

Volt Typhoon has used PowerShell including for remote system discovery.

Patchwork used PowerSploit to download payloads, run a reverse shell, and execute malware on the victim's machine.

APT41 leveraged PowerShell to deploy malware families in victims’ environments.

Dragonfly has used PowerShell scripts for execution.

Gorgon Group malware can use PowerShell commands to download and execute a payload and open a decoy document on the victim’s machine.

menuPass uses PowerSploit to inject shellcode into PowerShell.

APT32 has used PowerShell-based tools, PowerShell one-liners, and shellcode loaders for execution.

HAFNIUM has used the Exchange Power Shell module Set-OabVirtualDirectoryPowerShell to export mailbox data.

MuddyWater has used PowerShell for execution.

FIN6 has used PowerShell to gain access to merchant's networks, and a Metasploit PowerShell module to download and execute shellcode and to set up a local listener.

Gamaredon Group has used obfuscated PowerShell scripts for staging. Additionally, (LinkById : G0047) has used PowerShell based tools later in its attack chain. Additionally, Gamaredon Group has used the PowerShell cmdlet `Get-Command` to download and execute the next stage payload.

Gallmaker used PowerShell to download additional payloads and for execution.

Storm-1811 has used PowerShell for multiple purposes, such as using PowerShell scripts executing in an infinite loop to create an SSH connection to a command and control server.

TeamTNT has executed PowerShell commands in batch scripts.

FIN7 used a PowerShell script to launch shellcode that retrieved an additional payload. Additionally, FIN7 has executed a custom obfuscation of the shellcode invoker in PowerSploit called POWERTRASH.

Sandworm Team has used PowerShell scripts to run a credential harvesting tool in memory to evade defenses.

CURIUM has leveraged PowerShell scripts for initial process execution and data gathering in victim environments.

Sidewinder has used PowerShell to drop and execute malware loaders.

Mustang Panda has used malicious PowerShell scripts to enable execution.

Scattered Spider has used the PowerShell cmdlet Get-ADUser.

APT39 has used PowerShell to execute malicious code.

UNC3886 has used a PowerShell script to search memory dumps for credentials.

TA2541 has used PowerShell to download files and to inject into various Windows processes.

Akira has used PowerShell scripts for credential harvesting and privilege escalation.

OilRig has used PowerShell scripts for execution, including use of a macro to run a PowerShell command to decode file contents.

TA459 has used PowerShell for execution of a payload.

Aquatic Panda has downloaded additional scripts and executed Base64 encoded commands in PowerShell.

Saint Bear relies extensively on PowerShell execution from malicious attachments and related content to retrieve and execute follow-on payloads.

DarkHydrus leveraged PowerShell to download and execute additional scripts for execution.

Confucius has used PowerShell to execute malicious files and payloads.

Leviathan has used PowerShell for execution.

MoustachedBouncer has used plugins to execute PowerShell scripts.

Blue Mockingbird has used PowerShell reverse TCP shells to issue interactive commands over a network connection.

Winter Vivern passed execution from document macros to PowerShell scripts during initial access operations. Winter Vivern used batch scripts that called PowerShell commands as part of initial access and installation operations.

Turla has used PowerShell to execute commands/scripts, in some cases via a custom executable or code from Empire's PSInject. Turla has also used PowerShell scripts to load and execute malware in memory.

Storm-0501 has leveraged PowerShell to execute commands and scripts.

The Poseidon Group's Information Gathering Tool (IGT) includes PowerShell components.

TA505 has used PowerShell to download and execute malware and reconnaissance scripts.

DarkVishnya used PowerShell to create shellcode loaders.

RedCurl has used PowerShell to execute commands and to download malware.

Stealth Falcon malware uses PowerShell commands to perform various functions, including gathering system information via WMI and executing commands from its C2 server.

APT29 has used encoded PowerShell scripts uploaded to CozyCar installations to download and install SeaDuke.

Cinnamon Tempest has used PowerShell to communicate with C2, download files, and execute reconnaissance commands.

Chimera has used PowerShell scripts to execute malicious payloads and the DSInternals PowerShell module to make use of Active Directory features.