THREATNOIR
Subscribe
MITRE ATT&CK · T1059.001

PowerShell

MITRE · cited in 22 of our lessons

Explanation

What attackers do. Attackers abuse PowerShell to run commands, download tools, move through the network and execute code in memory. As it is built into Windows and powerful, it is a favourite for the Execution tactic.

How to defend. Enable PowerShell script block, module and transcription logging and forward the events centrally. Use constrained language mode with application control for most users, remove PowerShell version 2, and restrict remoting to administrators. Antimalware scan interface integration lets security tools see scripts after they are decoded.

Signs to look for. Look for encoded commands, hidden windows, download cradles, PowerShell launched by Office, browsers or web servers, and connections out to the internet from PowerShell. A common gap is collecting process start events but not the script content itself.

Open the technique on MITRE ATT&CK
The official text
Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. PowerShell can also be installed on Linux and macOS. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems). PowerShell may also be used to download and run executables from the Internet, which can be executed from disk or in memory without touching disk. A number of PowerShell-based offensive testing tools are available, including Empire, PowerSploit, PoshC2, and PSAttack.

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).

Lessons that cite it

Real incidents where this item mattered: the latest 12 of 22.