Technique:  Command and Scripting Interpreter:PowerShell
During the 2016 Ukraine Electric Power Attack, It used PowerShell scripts to run a credential harvesting tool in memory to evade defenses.
AADInternals is written and executed via PowerShell.
AppleSeed has the ability to execute its payload via PowerShell.
It used PowerShell commands to execute payloads.
It downloads and executes PowerShell scripts and performs PowerShell commands.
It has used encoded PowerShell scripts uploaded to CozyCar installations to download and install SeaDuke.
It has used PowerShell on victim systems to download and run payloads after exploitation.
It has used PowerShell-based tools, PowerShell one-liners, and shellcode loaders for execution.
It has utilized PowerShell to download files from the C2 server and run various scripts.
It has used PowerShell to execute commands and other operational tasks.
It has used PowerShell to execute malicious code.
It leveraged PowerShell to deploy malware families in victims’ environments.
It has downloaded additional scripts and executed Base64 encoded commands in PowerShell.
AutoIt backdoor downloads a PowerShell script that decodes to a typical shellcode loader.
BADHATCH can utilize powershell.exe to execute commands on a compromised host.
Bandook has used PowerShell loaders as part of execution.
Bazar can execute a PowerShell script received from C2.
Black Basta has used PowerShell scripts for discovery and to execute files over the network.
BloodHound can use PowerShell to pull Active Directory information from the target environment.
It has used PowerShell reverse TCP shells to issue interactive commands over a network connection.
BONDUPDATER is written in PowerShell.
It has used PowerShell for execution.
Bumblebee can use PowerShell for execution.
During C0018, the threat actors used encoded PowerShell scripts for execution.
During C0021, the threat actors used obfuscated PowerShell to extract an encoded payload from within an .LNK file.
CharmPower can use PowerShell for payload execution and C2 communication.
It has used PowerShell scripts to execute malicious payloads and the DSInternals PowerShell module to make use of Active Directory features.
The Clambling dropper can use PowerShell to download the malware.
It has used powershell.exe to download and execute scripts.
Cobalt Strike can execute a payload on a remote host with PowerShell. This technique does not write any data to disk. Cobalt Strike can also use PowerSploit and other scripting frameworks to perform execution.
ComRAT has used PowerShell to load itself every time a user logs in to the system. ComRAT can execute PowerShell scripts loaded into memory or from the file system.
It has used PowerShell to execute malicious files and payloads.
ConnectWise can be used to execute PowerShell commands on target machines.
It has used PowerShell Empire.
CrackMapExec can execute PowerShell commands via WMI.
CreepyDrive can use Powershell for execution, including the cmdlets Invoke-WebRequest and Invoke-Expression.
CreepySnail can use PowerShell for execution, including the cmdlets Invoke-WebRequst and Invoke-Expression.
Cuba has been dropped onto systems and used for lateral movement via obfuscated PowerShell scripts.
It leveraged PowerShell to download and execute additional scripts for execution.
It used PowerShell to create shellcode loaders.
DarkWatchman can execute PowerShell commands and has used PowerShell to execute a keylogger.
It has used PowerShell scripts to download and execute programs in memory, without writing to disk.
Denis has a version written in PowerShell.
Donut can generate shellcode outputs that execute via PowerShell.
DownPaper uses PowerShell for execution.
It has used PowerShell scripts for execution.
It has used PowerShell to execute commands.
Egregor has used an encoded PowerShell command by a service created by Cobalt Strike for lateral movement.
It has used PowerShell to download and execute malicious code.
Emotet has used Powershell to retrieve the malicious payload and download additional resources like Mimikatz.
Empire leverages PowerShell for the majority of its client-side agent tasks. Empire also contains the ability to conduct PowerShell remoting with the Invoke-PSRemoting module.
FatDuke has the ability to execute PowerShell scripts.
Ferocious can use PowerShell scripts for execution.
It uses PowerShell for execution as well as PowerShell Empire to establish persistence.
It has used PowerShell commands to obtain DNS data from a compromised network.
It has used PowerShell to gain access to merchant's networks, and a Metasploit PowerShell module to download and execute shellcode and to set up a local listener.
It used a PowerShell script to launch shellcode that retrieved an additional payload.
It's malicious spearphishing payloads are executed as PowerShell. It has also used PowerShell for lateral movement and credential access.
FlawedAmmyy has used PowerShell to execute commands.
It has used PowerShell scripts to access credential data.
During Frankenstein, the threat actors used PowerShell to run a series of Base64-encoded commands that acted as a stager and enumerated hosts.
It used PowerShell for execution to assist in lateral movement as well as for dumping credentials stored on compromised machines.
It used PowerShell to download additional payloads and for execution.
It has used obfuscated PowerShell scripts for staging.
It has staged and executed PowerShell scripts on compromised hosts.
It malware can use PowerShell commands to download and execute a payload and open a decoy document on the victim’s machine.
GRIFFON has used PowerShell to execute the Meterpreter downloader TinyMet.
It has used the Exchange Power Shell module Set-OabVirtualDirectoryPowerShell to export mailbox data.
HALFBAKED can execute PowerShell scripts.
HAMMERTOSS is known to use PowerShell.
Hancitor has used PowerShell to execute commands.
One version of Helminth uses a PowerShell script.
It has used PowerShell-based tools and scripts for discovery and collection on compromised hosts.
It has used PowerShell to execute malicious commands and payloads.
It has used PowerShell Empire for execution of malware.
JCry has used PowerShell to execute payloads.
JSS Loader has the ability to download and execute PowerShell scripts.
KeyBoy uses PowerShell commands to download and execute payloads.
KGH_SPY can execute PowerShell commands on the victim's machine.
It has executed a variety of PowerShell scripts.
Koadic has used PowerShell to establish persistence.
KOCTOPUS has used PowerShell commands to download additional files.
KONNI used PowerShell to download and execute a specific 64-bit version of the malware.
It has used PowerShell to execute commands and malicious code.
It has used PowerShell scripts to execute malicious code.
It has used PowerShell for execution.
LitePower can use a PowerShell script to execute commands.
Lizar has used PowerShell scripts.
Lokibot has used PowerShell commands embedded inside batch scripts.
Mafalda can execute PowerShell commands on a compromised machine.
It has used PowerShell for execution and privilege escalation.
It uses PowerSploit to inject shellcode into PowerShell.
Meteor can use PowerShell commands to disable the network adapters on a victim machines.
MoleNet can use PowerShell to set persistence.
It used PowerShell implants on target machines.
Mosquito can launch PowerShell Scripts.
It has used plugins to execute PowerShell scripts.
It has used PowerShell for execution.
It has used malicious PowerShell scripts to enable execution.
Netwalker has been written in PowerShell and executed directly in memory, avoiding detection.
The NETWIRE binary has been executed via PowerShell script.
njRAT has executed PowerShell commands via auto-run registry key persistence.
It has used PowerShell for execution.
It has used PowerShell scripts for execution, including use of a macro to run a PowerShell command to decode file contents.
During Operation Dream Job, It used PowerShell commands to explore the environment of compromised victims.
During Operation Wocao, threat actors used PowerShell on compromised systems.
OSX_OCEANLOTUS.D uses PowerShell scripts.
It used PowerSploit to download payloads, run a reverse shell, and execute malware on the victim's machine.
Pillowmint has used a PowerShell script to install a shim database.
The It's Information Gathering Tool (IGT) includes PowerShell components.
POSHSPY uses PowerShell to execute various commands, one to execute its payload.
PowerLess is written in and executed via PowerShell without using powershell.exe.
PowerPunch has the ability to execute through PowerShell.
PowerShower is a backdoor written in PowerShell.
POWERSOURCE is a PowerShell backdoor.
PowerSploit modules are written in and executed via PowerShell.
PowerStallion uses PowerShell loops to iteratively check for available commands in its OneDrive C2 server.
POWERSTATS uses PowerShell for obfuscation and execution.
POWERTON is written in PowerShell.
PowGoop has the ability to use PowerShell scripts to execute commands.
POWRUNER is written in PowerShell.
Prestige can use PowerShell for payload execution on targeted systems.
PS1 can utilize a PowerShell loader.
PUNCHBUGGY has used PowerShell scripts.
Pupy has a module for loading and executing PowerShell scripts.
PyDCrypt has attempted to execute with PowerShell.
Pysa has used Powershell scripts to deploy its ransomware.
QakBot can use PowerShell to download and execute payloads.
QUADAGENT uses PowerShell scripts for execution.
There is a variant of RATANKBA that uses a PowerShell script instead of the traditional PE form.
RegDuke can extract and execute PowerShell scripts from C2 communications.
Revenge RAT uses the PowerShell command Reflection.Assembly to load itself into memory to aid in execution.
REvil has used PowerShell to delete volume shadow copies and download files.
RogueRobin uses a command prompt to run a PowerShell script from Excel. To assist in establishing persistence, RogueRobin creates %APPDATA%\OneDrive.bat and saves the following string to it:powershell.exe -WindowStyle Hidden -exec bypass -File "%APPDATA%\OneDrive.ps1".
Saint Bot has used PowerShell for execution.
It has used PowerShell scripts to run a credential harvesting tool in memory to evade defenses.
Sardonic has the ability to execute PowerShell commands on a compromised machine.
SeaDuke uses a module to execute Mimikatz with PowerShell to perform Pass the Ticket.
ServHelper has the ability to execute a PowerShell script to get information from the infected host.
SharpStage can execute arbitrary commands with PowerShell.
SHARPSTATS has the ability to employ a custom PowerShell script.
It has used PowerShell to drop and execute malware loaders.
It has used PowerShell to download and execute payloads.
SILENTTRINITY can use PowerShell to execute commands.
SMOKEDHAM can execute Powershell commands sent from its C2 server.
Snip3 can use a PowerShell script for second-stage execution.
Socksbot can write and execute PowerShell scripts.
During the SolarWinds Compromise, It used PowerShell to create new tasks on remote machines, identify configuration settings, exfiltrate data, and execute other commands.
SQLRat has used PowerShell to create a Meterpreter session.
Squirrelwaffle has used PowerShell to execute its payload.
It malware uses PowerShell commands to perform various functions, including gathering system information via WMI and executing commands from its C2 server.
StrongPity can use PowerShell to add files to the Windows Defender exclusions list.
It has used PowerShell to download files and to inject into various Windows processes.
It has used PowerShell for execution of a payload.
It has used PowerShell to download and execute malware and reconnaissance scripts.
It has executed PowerShell commands in batch scripts.
It has used a publicly-available PowerShell-based tool, WMImplant. The group has also used PowerShell to perform Timestomping.
It has used PowerShell for execution.
It leveraged PowerShell to run commands to download payloads, traverse the compromised networks, and carry out reconnaissance.
It has used PowerShell to download additional payloads.
TrickBot has been known to use PowerShell to download new payloads, open documents, and upload data to command and control servers.
It has used PowerShell to execute commands/scripts, in some cases via a custom executable or code from Empire's PSInject. It has also used PowerShell scripts to load and execute malware in memory.
Ursnif droppers have used PowerShell in download cradles to download and execute the malware's full executable payload.
Valak has used PowerShell to download additional modules.
It has used PowerShell including for remote system discovery.
WarzoneRAT can use PowerShell to download files and execute commands.
WellMess can execute PowerShell scripts received from C2.
WhisperGate can use PowerShell to support multiple actions including execution and defense evasion.
It has used PowerShell for script execution.
It has used macros to execute PowerShell scripts to download malware on victim's machines. It has also used PowerShell to execute commands and move laterally through a victim network.
Woody RAT can execute PowerShell commands and scripts with the use of .NET DLL, WoodyPowerSession.
Xbash can use scripts to invoke PowerShell to download a malicious PE executable or PE DLL for execution.
Zeus Panda uses PowerShell to download and execute the payload.