MITRE ATT&CKsoftware (tool)
S0231 Invoke-PSImage
- Domain
- enterprise
- Version
- 1.1
- Created
- 2018-04-18
Description
Invoke-PSImage takes a PowerShell script and embeds the bytes of the script into the pixels of a PNG image. It generates a one liner for executing either from a file of from the web. Example of usage is embedding the PowerShell code from the Invoke-Mimikatz module and embed it into an image file. By calling the image file from a macro for example, the macro will download the picture and execute the PowerShell code, which in this case will dump the passwords.
Related
Uses · MITRE ATT&CK (2)
Referenced by MITRE ATT&CK · uses (1)
- G0034 Sandworm Team group
References
- https://github.com/peewpw/Invoke-PSImage GitHub Invoke-PSImage