MITRE ATT&CKsub-technique

T1059.001 PowerShell

Published 2020-03-09 Modified 2026-09-18 Official page ↗
Domain
enterprise
Tactics
Execution
Platforms
Windows, Linux, macOS
Version
1.6
Created
2020-03-09

Description

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. PowerShell can also be installed on Linux and macOS. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the Start-Process cmdlet which can be used to run an executable and the Invoke-Command cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems). PowerShell may also be used to download and run executables from the Internet, which can be executed from disk or in memory without touching disk. A number of PowerShell-based offensive testing tools are available, including Empire, PowerSploit, PoshC2, and PSAttack. PowerShell commands/scripts can also be executed without directly invoking the powershell.exe binary through interfaces to PowerShell's underlying System.Management.Automation assembly DLL exposed through the .NET framework and Windows Common Language Interface (CLI).

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1059 Command and Scripting Interpreter technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (5)

  • M1038 Execution Prevention mitigation
  • M1042 Disable or Remove Feature or Program mitigation
  • M1045 Code Signing mitigation
  • M1049 Antivirus/Antimalware mitigation
  • M1026 Privileged Account Management mitigation

Referenced by MITRE ATT&CK · uses (237)

  • G1059 NIMBUS MANTICORE group
  • S9051 The Gentlemen Ransomware software (malware)
  • S9050 Vidar software (malware)
  • C0064 AI-Assisted Breach of Mexico's Government Infrastructure campaign
  • S9039 LazyWiper software (malware)
  • S9036 LP-Notes software (malware)
  • G1055 VOID MANTICORE group
  • S9032 MuddyViper software (malware)
  • S9034 Tsundere Botnet software (malware)
  • C0060 Operation AkaiRyū campaign
  • S9019 PureCrypter software (malware)
  • S9008 Shai-Hulud software (malware)
  • S9001 SystemBC software (malware)
  • G1053 Storm-0501 group
  • S1244 Medusa Ransomware software (malware)
  • S1245 InvisibleFerret software (malware)
  • C0058 SharePoint ToolShell Exploitation campaign
  • G1051 Medusa Group group
  • S1242 Qilin software (malware)
  • S1229 Havoc software (malware)
  • G1048 UNC3886 group
  • S1213 Lumma Stealer software (malware)
  • S1212 RansomHub software (malware)
  • G1046 Storm-1811 group
  • C0051 APT28 Nearest Neighbor Campaign campaign
  • S1202 LockBit 3.0 software (malware)
  • S1201 TRANSLATEXT software (malware)
  • S1199 LockBit 2.0 software (malware)
  • S1196 Troll Stealer software (malware)
  • C0047 RedDelta Modified PlugX Infection Chain Operations campaign
Show all 237 ›

Referenced by Compliance · mitigates (24)

  • CIS-10.1 Deploy and Maintain Anti-Malware Software CIS Safeguard v8.1
  • CIS-10.7 Use Behavior-Based Anti-Malware Software CIS Safeguard v8.1
  • CIS-13.7 Deploy a Host-Based Intrusion Prevention Solution CIS Safeguard v8.1
  • CIS-2.7 Allowlist Authorized Scripts CIS Safeguard v8.1
  • CIS-9.7 Deploy and Maintain Email Server Anti-Malware Protections CIS Safeguard v8.1
  • NIST-AC-17 Remote Access NIST 800-53 control
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-5 Access Restrictions for Change NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-8 System Component Inventory NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
  • NIST-IA-8 Identification and Authentication (Non-organizational Users) NIST 800-53 control
  • NIST-IA-9 Service Identification and Authentication NIST 800-53 control
  • NIST-RA-5 Vulnerability Monitoring and Scanning NIST 800-53 control
  • NIST-SI-10 Information Input Validation NIST 800-53 control
  • NIST-SI-16 Memory Protection NIST 800-53 control
  • NIST-SI-2 Flaw Remediation NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control

References