[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1059-001":3},{"item":4,"lessons":18,"controls":68,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1059-001","T1059.001","PowerShell",22,"MITRE","**What attackers do.** Attackers abuse PowerShell to run commands, download tools, move through the network and execute code in memory. As it is built into Windows and powerful, it is a favourite for the Execution tactic.\n\n**How to defend.** Enable PowerShell script block, module and transcription logging and forward the events centrally. Use constrained language mode with application control for most users, remove PowerShell version 2, and restrict remoting to administrators. Antimalware scan interface integration lets security tools see scripts after they are decoded.\n\n**Signs to look for.** Look for encoded commands, hidden windows, download cradles, PowerShell launched by Office, browsers or web servers, and connections out to the internet from PowerShell. A common gap is collecting process start events but not the script content itself.","Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. PowerShell can also be installed on Linux and macOS. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).\n\nPowerShell may also be used to download and run executables from the Internet, which can be executed from disk or in memory without touching disk.\n\nA number of PowerShell-based offensive testing tools are available, including Empire,  PowerSploit, PoshC2, and PSAttack.","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1059\u002F001\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"clickfix-attack-abuses-browser-cache-to-smuggle-malicious-payloads","ClickFix Attack Abuses Browser Cache to Smuggle Malicious Payloads","2026-10-06T08:21:47.852+00:00",{"slug":25,"title":26,"published_at":27},"chatgpt-custom-gpts-weaponized-in-clickfix-social-engineering-campaign","ChatGPT Custom GPTs Weaponized in ClickFix Social Engineering Campaign","2026-09-29T14:20:43.365+00:00",{"slug":29,"title":30,"published_at":31},"fake-chatgpt-custom-gpt-delivers-rat-via-eight-stage-clickfix-attack","Fake ChatGPT Custom GPT Delivers RAT via Eight-Stage ClickFix Attack","2026-09-29T12:21:55.079+00:00",{"slug":33,"title":34,"published_at":35},"compromised-placeholder-domain-delivers-clickfix-social-engineering-attack","Compromised Placeholder Domain Delivers ClickFix Social Engineering Attack","2026-09-24T00:20:25.624+00:00",{"slug":37,"title":38,"published_at":39},"taskstomp-backdoor-uses-scheduled-tasks-and-powershell-for-stealthy-document-theft","TASK#STOMP Backdoor Uses Scheduled Tasks and PowerShell for Stealthy Document Theft","2026-09-22T12:22:08.004+00:00",{"slug":41,"title":42,"published_at":43},"powershell-backdoor-taskstomp-exfiltrates-sensitive-data-via-phishing","PowerShell Backdoor TASK#STOMP Exfiltrates Sensitive Data via Phishing","2026-09-21T16:21:38.292+00:00",{"slug":45,"title":46,"published_at":47},"terminalfix-campaign-abuses-powershell-and-reverse-tunnels-for-deep-enterprise-infiltration","TerminalFix Campaign Abuses PowerShell and Reverse Tunnels for Deep Enterprise Infiltration","2026-08-31T22:21:13.202+00:00",{"slug":49,"title":50,"published_at":51},"terminalfix-malware-uses-fake-captchas-to-trick-users-into-opening-reverse-tunnels","TerminalFix Malware Uses Fake CAPTCHAs to Trick Users into Opening Reverse Tunnels","2026-08-31T20:20:31.988+00:00",{"slug":53,"title":54,"published_at":55},"terminalfix-campaign-exploits-user-trust-to-deploy-persistent-reverse-tunnels","TerminalFix Campaign Exploits User Trust to Deploy Persistent Reverse Tunnels","2026-08-29T06:20:25.828+00:00",{"slug":57,"title":58,"published_at":59},"sandworm-targets-it-pros-with-trojanized-vpn-client-via-fake-job-offers","Sandworm Targets IT Pros with Trojanized VPN Client via Fake Job Offers","2026-08-11T22:21:23.879+00:00",{"slug":61,"title":62,"published_at":63},"clickfix-attacks-on-steam-forums-spread-xmrig-cryptominer-via-social-engineering","ClickFix Attacks on Steam Forums Spread XMRig Cryptominer via Social Engineering","2026-07-26T00:20:19.825+00:00",{"slug":65,"title":66,"published_at":67},"fake-captchas-trick-ukrainian-users-into-running-malicious-powershell","Fake CAPTCHAs Trick Ukrainian Users into Running Malicious PowerShell","2026-07-19T16:20:42.475+00:00",[69,73,78,83,88,93],{"slug":70,"name":71,"problem":72,"stories":9},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":74,"name":75,"problem":76,"stories":77},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",14,{"slug":79,"name":80,"problem":81,"stories":82},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",11,{"slug":84,"name":85,"problem":86,"stories":87},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",4,{"slug":89,"name":90,"problem":91,"stories":92},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",3,{"slug":94,"name":95,"problem":96,"stories":97},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",2,[99,105,111,116,120,125,130,135],{"family":100,"item":101,"code":102,"title":103,"together":104},"nist-800-53","si-3","SI-3","Malicious Code Protection",19,{"family":106,"item":107,"code":108,"title":109,"together":110},"cis","2","Control 2","Inventory and Control of Software Assets",17,{"family":106,"item":112,"code":113,"title":114,"together":115},"9","Control 9","Email and Web Browser Protections",16,{"family":106,"item":117,"code":118,"title":119,"together":77},"14","Control 14","Security Awareness and Skills Training",{"family":106,"item":121,"code":122,"title":123,"together":124},"13","Control 13","Network Monitoring and Defense",13,{"family":100,"item":126,"code":127,"title":128,"together":129},"at-2","AT-2","Literacy Training and Awareness",10,{"family":131,"item":132,"code":133,"title":134,"together":129},"gdpr","32","Article 32","Security of processing",{"family":100,"item":136,"code":137,"title":138,"together":139},"au-12","AU-12","Audit Record Generation",9]