Description
Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.(Citation: TechNet PowerShell) Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the Start-Process cmdlet which can be used to run an executable and the Invoke-Command cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
PowerShell may also be used to download and run executables from the Internet, which can be executed from disk or in memory without touching disk.
A number of PowerShell-based offensive testing tools are available, including Empire, PowerSploit, PoshC2, and PSAttack.(Citation: Github PSAttack)
PowerShell commands/scripts can also be executed without directly invoking the powershell.exe binary through interfaces to PowerShell's underlying System.Management.Automation assembly DLL exposed through the .NET framework and Windows Common Language Interface (CLI).(Citation: Sixdub PowerPick Jan 2016)(Citation: SilentBreak Offensive PS Dec 2015)(Citation: Microsoft PSfromCsharp APR 2014)
Reverse Shell Cheatsheet
Read our in-depth pentesting guide related to this technique
Platforms
Mitigations (5)
Execution PreventionM1038
Use application control where appropriate. PowerShell Constrained Language mode can be used to restrict access to sensitive or otherwise dangerous language elements such as those used to execute arbitrary Windows APIs or files (e.g., Add-Type).(Citation: Microsoft PowerShell CLM)
Code SigningM1045
Set PowerShell execution policy to execute only signed scripts.
Privileged Account ManagementM1026
When PowerShell is necessary, consider restricting PowerShell execution policy to administrators. Be aware that there are methods of bypassing the PowerShell execution policy, depending on environment configuration.(Citation: Netspi PowerShell Execution Policy Bypass)
PowerShell JEA (Just Enough Administration) may also be used to sandbox administration and limit what commands admins/users can ex
Antivirus/AntimalwareM1049
Anti-virus can be used to automatically quarantine suspicious files.
Disable or Remove Feature or ProgramM1042
It may be possible to remove PowerShell from systems when not needed, but a review should be performed to assess the impact to an environment, since it could be in use for many legitimate purposes and administrative functions.
Disable/restrict the WinRM Service to help prevent uses of PowerShell for remote execution.
Threat Groups (85)
| ID | Group | Context |
|---|---|---|
| G0082 | APT38 | [APT38](https://attack.mitre.org/groups/G0082) has used PowerShell to execute commands and other operational tasks.(Citation: CISA AA20-239A BeagleBoy... |
| G0119 | Indrik Spider | [Indrik Spider](https://attack.mitre.org/groups/G0119) has used PowerShell [Empire](https://attack.mitre.org/software/S0363) for execution of malware.... |
| G1043 | BlackByte | [BlackByte](https://attack.mitre.org/groups/G1043) used encoded PowerShell commands during operations.(Citation: FBI BlackByte 2022) [BlackByte](https... |
| G0093 | GALLIUM | [GALLIUM](https://attack.mitre.org/groups/G0093) used PowerShell for execution to assist in lateral movement as well as for dumping credentials stored... |
| G0022 | APT3 | [APT3](https://attack.mitre.org/groups/G0022) has used PowerShell on victim systems to download and run payloads after exploitation.(Citation: FireEye... |
| G0094 | Kimsuky | [Kimsuky](https://attack.mitre.org/groups/G0094) has executed a variety of PowerShell scripts including Invoke-Mimikatz.(Citation: EST Kimsuky April 2... |
| G1017 | Volt Typhoon | [Volt Typhoon](https://attack.mitre.org/groups/G1017) has used PowerShell including for remote system discovery.(Citation: Microsoft Volt Typhoon May ... |
| G0040 | Patchwork | [Patchwork](https://attack.mitre.org/groups/G0040) used [PowerSploit](https://attack.mitre.org/software/S0194) to download payloads, run a reverse she... |
| G0096 | APT41 | [APT41](https://attack.mitre.org/groups/G0096) leveraged PowerShell to deploy malware families in victims’ environments.(Citation: FireEye APT41 Aug 2... |
| G0035 | Dragonfly | [Dragonfly](https://attack.mitre.org/groups/G0035) has used PowerShell scripts for execution.(Citation: US-CERT TA18-074A)(Citation: Symantec Dragonfl... |
| G0078 | Gorgon Group | [Gorgon Group](https://attack.mitre.org/groups/G0078) malware can use PowerShell commands to download and execute a payload and open a decoy document ... |
| G0045 | menuPass | [menuPass](https://attack.mitre.org/groups/G0045) uses [PowerSploit](https://attack.mitre.org/software/S0194) to inject shellcode into PowerShell.(Cit... |
| G0050 | APT32 | [APT32](https://attack.mitre.org/groups/G0050) has used PowerShell-based tools, PowerShell one-liners, and shellcode loaders for execution.(Citation: ... |
| G0125 | HAFNIUM | [HAFNIUM](https://attack.mitre.org/groups/G0125) has used the Exchange Power Shell module <code>Set-OabVirtualDirectoryPowerShell</code> to export mai... |
| G0069 | MuddyWater | [MuddyWater](https://attack.mitre.org/groups/G0069) has used PowerShell for execution.(Citation: FireEye MuddyWater Mar 2018)(Citation: MuddyWater Tre... |
| G0037 | FIN6 | [FIN6](https://attack.mitre.org/groups/G0037) has used PowerShell to gain access to merchant's networks, and a Metasploit PowerShell module to downlo... |
| G0047 | Gamaredon Group | [Gamaredon Group](https://attack.mitre.org/groups/G0047) has used obfuscated PowerShell scripts for staging.(Citation: Microsoft Actinium February 202... |
| G0084 | Gallmaker | [Gallmaker](https://attack.mitre.org/groups/G0084) used PowerShell to download additional payloads and for execution.(Citation: Symantec Gallmaker Oct... |
| G1046 | Storm-1811 | [Storm-1811](https://attack.mitre.org/groups/G1046) has used PowerShell for multiple purposes, such as using PowerShell scripts executing in an infini... |
| G0139 | TeamTNT | [TeamTNT](https://attack.mitre.org/groups/G0139) has executed PowerShell commands in batch scripts.(Citation: ATT TeamTNT Chimaera September 2020) |
Associated Software (131)
| ID | Name | Type | Context |
|---|---|---|---|
| S0266 | TrickBot | Malware | [TrickBot](https://attack.mitre.org/software/S0266) has been known to use PowerShell to download new payloads, open documents, and upload data to comm... |
| S1039 | Bumblebee | Malware | [Bumblebee](https://attack.mitre.org/software/S1039) can use PowerShell for execution.(Citation: Medium Ali Salem Bumblebee April 2022) |
| S0417 | GRIFFON | Malware | [GRIFFON](https://attack.mitre.org/software/S0417) has used PowerShell to execute the Meterpreter downloader TinyMet.(Citation: SecureList Griffon May... |
| S0184 | POWRUNER | Malware | [POWRUNER](https://attack.mitre.org/software/S0184) is written in PowerShell.(Citation: FireEye APT34 Dec 2017) |
| S0546 | SharpStage | Malware | [SharpStage](https://attack.mitre.org/software/S0546) can execute arbitrary commands with PowerShell.(Citation: Cybereason Molerats Dec 2020)(Citation... |
| S1085 | Sardonic | Malware | [Sardonic](https://attack.mitre.org/software/S1085) has the ability to execute PowerShell commands on a compromised machine.(Citation: Bitdefender Sar... |
| S0151 | HALFBAKED | Malware | [HALFBAKED](https://attack.mitre.org/software/S0151) can execute PowerShell scripts.(Citation: FireEye FIN7 April 2017) |
| S1193 | TAMECAT | Malware | [TAMECAT](https://attack.mitre.org/software/S1193) has used PowerShell to download and run additional content.(Citation: Mandiant APT42-untangling) |
| S0613 | PS1 | Malware | [PS1](https://attack.mitre.org/software/S0613) can utilize a PowerShell loader.(Citation: BlackBerry CostaRicto November 2020) |
| S0386 | Ursnif | Malware | [Ursnif](https://attack.mitre.org/software/S0386) droppers have used PowerShell in download cradles to download and execute the malware's full executa... |
| S1212 | RansomHub | Malware | [RansomHub](https://attack.mitre.org/software/S1212) can use PowerShell to delete volume shadow copies.(Citation: Group-IB RansomHub FEB 2025) |
| S0145 | POWERSOURCE | Malware | [POWERSOURCE](https://attack.mitre.org/software/S0145) is a PowerShell backdoor.(Citation: FireEye FIN7 March 2017)(Citation: Cisco DNSMessenger March... |
| S9034 | Tsundere Botnet | Malware | [Tsundere Botnet](https://attack.mitre.org/software/S9034) has been distributed via a PowerShell script.(Citation: SecureListUbiedo_Tsundere_Nov2025)(... |
| S0330 | Zeus Panda | Malware | [Zeus Panda](https://attack.mitre.org/software/S0330) uses PowerShell to download and execute the payload.(Citation: Talos Zeus Panda Nov 2017) |
| S1229 | Havoc | Malware | [Havoc](https://attack.mitre.org/software/S1229) can facilitate the execution of PowerShell commands.(Citation: Immersive Labs Havoc C2 APR 2024) |
| S1058 | Prestige | Malware | [Prestige](https://attack.mitre.org/software/S1058) can use PowerShell for payload execution on targeted systems.(Citation: Microsoft Prestige ransomw... |
| S1245 | InvisibleFerret | Malware | [InvisibleFerret](https://attack.mitre.org/software/S1245) has utilized a PowerShell script created in the victim’s home directory named “conf.ps1” th... |
| S0491 | StrongPity | Malware | [StrongPity](https://attack.mitre.org/software/S0491) can use PowerShell to add files to the Windows Defender exclusions list.(Citation: Talos Prometh... |
| S1244 | Medusa Ransomware | Malware | [Medusa Ransomware](https://attack.mitre.org/software/S1244) has launched PowerShell scripts for execution and defense evasion.(Citation: Palo Alto Un... |
| S0622 | AppleSeed | Malware | [AppleSeed](https://attack.mitre.org/software/S0622) has the ability to execute its payload via PowerShell.(Citation: Malwarebytes Kimsuky June 2021) |
Related CWE Weaknesses
References
- Babinec, K. (2014, April 28). Executing PowerShell scripts from C#. Retrieved April 22, 2019.
- Christensen, L.. (2015, December 28). The Evolution of Offensive PowerShell Invocation. Retrieved December 8, 2018.
- Dunwoody, M. (2016, February 11). GREATER VISIBILITY THROUGH POWERSHELL LOGGING. Retrieved February 16, 2016.
- Haight, J. (2016, April 21). PS>Attack. Retrieved September 27, 2024.
- Hastings, M. (2014, July 16). Investigating PowerShell Attacks. Retrieved December 1, 2021.
- Malware Archaeology. (2016, June). WINDOWS POWERSHELL LOGGING CHEAT SHEET - Win 7/Win 2008 or later. Retrieved June 24, 2016.
- Microsoft. (n.d.). Windows PowerShell Scripting. Retrieved April 28, 2016.
- Warner, J.. (2015, January 6). Inexorable PowerShell – A Red Teamer’s Tale of Overcoming Simple AppLocker Policies. Retrieved December 8, 2018.
Frequently Asked Questions
What is T1059.001 (PowerShell)?
T1059.001 is a MITRE ATT&CK technique named 'PowerShell'. It belongs to the Execution tactic(s). Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.(Cit...
How can T1059.001 be detected?
Detection of T1059.001 (PowerShell) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1059.001?
There are 5 documented mitigations for T1059.001. Key mitigations include: Execution Prevention, Code Signing, Privileged Account Management, Antivirus/Antimalware, Disable or Remove Feature or Program.
Which threat groups use T1059.001?
Known threat groups using T1059.001 include: APT38, Indrik Spider, BlackByte, GALLIUM, APT3, Kimsuky, Volt Typhoon, Patchwork.