Command and Scripting Interpreter: PowerShell

APT19 used PowerShell commands to execute payloads.^[76]

APT28 downloads and executes PowerShell scripts.^[81]

APT29 has used encoded PowerShell scripts uploaded to CozyCar installations to download and install SeaDuke. APT29 also used PowerShell scripts to evade defenses.^[18][65][66]

APT3 has used PowerShell on victim systems to download and run payloads after exploitation.^[77]

APT32 has used PowerShell-based tools, PowerShell one-liners, and shellcode loaders for execution.^[61][62][59]

APT33 has utilized PowerShell to download files from the C2 server and run various scripts. ^[110][111]

APT39 has used PowerShell to execute malicious code.^[130][131]

APT41 leveraged PowerShell to deploy malware families in victims’ environments.^[121][122]

AutoIt backdoor downloads a PowerShell script that decodes to a typical shellcode loader.^[15]

Blue Mockingbird has used PowerShell reverse TCP shells to issue interactive commands over a network connection.^[132]

BONDUPDATER is written in PowerShell.^[16][38]

BRONZE BUTLER has used PowerShell for execution.^[101]

Cobalt Group has used powershell.exe to download and execute scripts.^{[89][90][91][92][93][94]}

Cobalt Strike can execute a payload on a remote host with PowerShell. This technique does not write any data to disk.^[7] Cobalt Strike can also use PowerSploit and other scripting frameworks to perform execution.^[8][9]

ComRAT has used PowerShell to load itself every time a user logs in to the system. ComRAT can execute PowerShell scripts loaded into memory or from the file system.^[60]

CopyKittens has used PowerShell Empire.^[75]

DarkHydrus leveraged PowerShell to download and execute additional scripts for execution.^[21][80]

DarkVishnya used PowerShell to create shellcode loaders.^[129]

Deep Panda has used PowerShell scripts to download and execute programs in memory, without writing to disk.^[84]

Denis has a version written in PowerShell.^[59]

DownPaper uses PowerShell for execution.^[20]

Dragonfly 2.0 used PowerShell scripts for execution.^[95][96][97]

Emotet has used Powershell to retrieve the malicious payload and download additional resources like Mimikatz. ^{[39][40][41][42][43]}

Empire leverages PowerShell for the majority of its client-side agent tasks. Empire also contains the ability to conduct PowerShell remoting with the Invoke-PSRemoting module.^[13][14]

FIN10 uses PowerShell for execution as well as PowerShell Empire to establish persistence.^[67][13]

FIN6 has used a Metasploit PowerShell module to download and execute shellcode and to set up a local listener.^[70][71]

FIN7 used a PowerShell script to launch shellcode that retrieved an additional payload.^[19][68]

FIN8's malicious spearphishing payloads are executed as PowerShell. FIN8 has also used PowerShell during Lateral Movement and Credential Access.^[98][99]

Frankenstein has used PowerShell to run a series of base64-encoded commands, that acted as a stager and enumerated hosts.^[126]

Gallmaker used PowerShell to download additional payloads and for execution.^[109]

Gorgon Group malware can use PowerShell commands to download and execute a payload and open a decoy document on the victim’s machine.^[102]

GRIFFON has used PowerShell to execute the Meterpreter downloader TinyMet.^[52]

HALFBAKED can execute PowerShell scripts.^[19]

HAMMERTOSS is known to use PowerShell.^[34]

One version of Helminth uses a PowerShell script.^[36]

Inception has used PowerShell to execute malicious commands and payloads.^[54][125]

JCry has used PowerShell to execute payloads.^[49]

KeyBoy uses PowerShell commands to download and execute payloads.^[48]

Kimsuky has executed a variety of PowerShell scripts.^[120]

KONNI used PowerShell to download and execute a specific 64-bit version of the malware.^[24]

Leviathan has used PowerShell for execution.^[73][74]

Magic Hound has used PowerShell for execution and privilege escalation.^[87][88]

menuPass uses PowerSploit to inject shellcode into PowerShell.^[100]

Molerats used PowerShell implants on target machines.^[128]

Mosquito can launch PowerShell Scripts.^[25]

MuddyWater has used PowerShell for execution.^{[103][104][105][106][29][107][108]}

Netwalker has been written in PowerShell and executed directly in memory, avoiding detection.^[55][56]

OilRig has used PowerShell scripts for execution, including use of a macro to run a PowerShell command to decode file contents.^[16][82][83]

OSX_OCEANLOTUS.D uses PowerShell scripts.^[53]

Patchwork used PowerSploit to download payloads, run a reverse shell, and execute malware on the victim's machine.^[78][37]

The Poseidon Group's Information Gathering Tool (IGT) includes PowerShell components.^[69]

POSHSPY uses PowerShell to execute various commands, one to execute its payload.^[35]

PowerShower is a backdoor written in PowerShell.^[54]

POWERSOURCE is a PowerShell backdoor.^[31][32]

PowerSploit modules are written in and executed via PowerShell.^[11][12]

PowerStallion uses PowerShell loops to iteratively check for available commands in its OneDrive C2 server.^[51]

POWERSTATS uses PowerShell for obfuscation and execution.^[28][29][30]

POWERTON is written in PowerShell.^[44]

POWRUNER is written in PowerShell.^[16]

PUNCHBUGGY has used PowerShell scripts.^[47]

Pupy has a module for loading and executing PowerShell scripts.^[10]

QUADAGENT uses PowerShell scripts for execution.^[23]

There is a variant of RATANKBA that uses a PowerShell script instead of the traditional PE form.^[26][27]

Revenge RAT uses the PowerShell command Reflection.Assembly to load itself into memory to aid in execution.^[45]

RogueRobin uses a command prompt to run a PowerShell script from Excel.^[21] To assist in establishing persistence, RogueRobin creates %APPDATA%\OneDrive.bat and saves the following string to it:powershell.exe -WindowStyle Hidden -exec bypass -File "%APPDATA%\OneDrive.ps1".^[22][21]

SeaDuke uses a module to execute Mimikatz with PowerShell to perform Pass the Ticket.^[18]

ServHelper has the ability to execute a PowerShell script to get information from the infected host.^[57]

SHARPSTATS has the ability to employ a custom PowerShell script.^[30]

Silence has used PowerShell to download and execute payloads.^[123][124]

Socksbot can write and execute PowerShell scripts.^[37]

Soft Cell used PowerShell for execution to assist in lateral movement as well as for dumping credentials stored on compromised machines.^[119]

SQLRat has used PowerShell to create a Meterpreter session.^[50]

Stealth Falcon malware uses PowerShell commands to perform various functions, including gathering system information via WMI and executing commands from its C2 server.^[79]

TA459 has used PowerShell for execution of a payload.^[85]

TA505 has used PowerShell to download and execute malware and reconnaissance scripts.^{[115][116][117][118]}

TEMP.Veles has used a publicly-available PowerShell-based tool, WMImplant.^[112] The group has also used PowerShell to perform Timestomping.^[113]

Threat Group-3390 has used PowerShell for execution.^[72]

Thrip leveraged PowerShell to run commands to download payloads, traverse the compromised networks, and carry out reconnaissance.^[86]

Turla has used PowerShell to execute commands/scripts, in some cases via a custom executable or code from Empire's PSInject.^[63][51][64] Turla has also used PowerShell scripts to load and execute malware in memory.

Ursnif droppers have used PowerShell in download cradles to download and execute the malware's full executable payload.^[46]

Valak has used PowerShell to download additional modules.^[58]

WIRTE has used PowerShell for script execution.^[114]

Wizard Spider has used macros to execute PowerShell scripts to download malware on victims machines.^[127]

Xbash can use scripts to invoke PowerShell to download a malicious PE executable or PE DLL for execution.^[33]

Zeus Panda uses PowerShell to download and execute the payload.^[17]

Anti-virus can be used to automatically quarantine suspicious files.

Set PowerShell execution policy to execute only signed scripts.

It may be possible to remove PowerShell from systems when not needed, but a review should be performed to assess the impact to an environment, since it could be in use for many legitimate purposes and administrative functions.

Disable/restrict the WinRM Service to help prevent uses of PowerShell for remote execution.

When PowerShell is necessary, restrict PowerShell execution policy to administrators. Be aware that there are methods of bypassing the PowerShell execution policy, depending on environment configuration.^[6]