MITRE ATT&CKsoftware (tool)
S0194 PowerSploit
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.6
- Created
- 2018-04-18
Description
PowerSploit is an open source, offensive security framework comprised of PowerShell modules and scripts that perform a wide range of tasks related to penetration testing such as code execution, persistence, bypassing anti-virus, recon, and exfiltration.
Related
Uses · MITRE ATT&CK (28)
- T1027.010 Command Obfuscation sub-technique
- T1620 Reflective Code Loading technique
- T1555.004 Windows Credential Manager sub-technique
- T1027.005 Indicator Removal from Tools sub-technique
- T1574.001 DLL sub-technique
- T1574.007 Path Interception by PATH Environment Variable sub-technique
- T1574.008 Path Interception by Search Order Hijacking sub-technique
- T1574.009 Path Interception by Unquoted Path sub-technique
- T1059.001 PowerShell sub-technique
- T1087.001 Local Account sub-technique
- T1003.001 LSASS Memory sub-technique
- T1056.001 Keylogging sub-technique
- T1552.006 Group Policy Preferences sub-technique
- T1558.003 Kerberoasting sub-technique
- T1552.002 Credentials in Registry sub-technique
- T1547.005 Security Support Provider sub-technique
- T1547.001 Registry Run Keys / Startup Folder sub-technique
- T1543.003 Windows Service sub-technique
- T1055.001 Dynamic-link Library Injection sub-technique
- T1053.005 Scheduled Task sub-technique
- T1482 Domain Trust Discovery technique
- T1134 Access Token Manipulation technique
- T1005 Data from Local System technique
- T1012 Query Registry technique
- T1047 Windows Management Instrumentation technique
- T1057 Process Discovery technique
- T1113 Screen Capture technique
- T1123 Audio Capture technique
References
- http://www.powershellmagazine.com/2014/07/08/powersploit/ PowerShellMagazine PowerSploit July 2014
- https://github.com/PowerShellMafia/PowerSploit GitHub PowerSploit May 2012
- http://powersploit.readthedocs.io PowerSploit Documentation