value:  APT41 leveraged PowerShell to deploy malware families in victims’ environments. ;; AutoIt backdoor downloads a PowerShell script that decodes to a typical shellcode loader. ;; Bazar can execute a PowerShell script received from C2. ;; BloodHound can use PowerShell to pull Active Directory information from the target environment. ;; Blue Mockingbird has used PowerShell reverse TCP shells to issue interactive commands over a network connection. ;; BONDUPDATER is written in PowerShell. ;; BRONZE BUTLER has used PowerShell for execution. ;; Chimera has used PowerShell scripts to execute malicious payloads and the DSInternals PowerShell module to make use of Active Directory features. ;; Cobalt Group has used powershell.exe to download and execute scripts. ;; Cobalt Strike can execute a payload on a remote host with PowerShell. This technique does not write any data to disk. Cobalt Strike can also use PowerSploit and other scripting frameworks to perform execution. ;; ComRAT has used PowerShell to load itself every time a user logs in to the system. ComRAT can execute PowerShell scripts loaded into memory or from the file system. ;; ConnectWise can be used to execute PowerShell commands on target machines. ;; CopyKittens has used PowerShell Empire. ;; CrackMapExec can execute PowerShell commands via WMI. ;; DarkHydrus leveraged PowerShell to download and execute additional scripts for execution. ;; DarkVishnya used PowerShell to create shellcode loaders. ;; Deep Panda has used PowerShell scripts to download and execute programs in memory without writing to disk. ;; Denis has a version written in PowerShell. ;; DownPaper uses PowerShell for execution. ;; Dragonfly 2.0 used PowerShell scripts for execution. ;; Egregor has used an encoded PowerShell command by a service created by Cobalt Strike for lateral movement. ;; Emotet has used Powershell to retrieve the malicious payload and download additional resources like Mimikatz. ;; Empire leverages PowerShell for the majority of its client-side agent tasks. Empire also contains the ability to conduct PowerShell remoting with the Invoke-PSRemoting module. ;; FatDuke has the ability to execute PowerShell scripts. ;; FIN10 uses PowerShell for execution as well as PowerShell Empire to establish persistence. ;; FIN6 has used PowerShell to gain access to merchant's networks and a Metasploit PowerShell module to download and execute shellcode and to set up a local listener. ;; FIN7 used a PowerShell script to launch shellcode that retrieved an additional payload. ;; FIN8's malicious spearphishing payloads are executed as PowerShell. FIN8 has also used PowerShell during Lateral Movement and Credential Access. ;; Fox Kitten has used PowerShell scripts to access credential data. ;; Frankenstein has used PowerShell to run a series of base64-encoded commands that acted as a stager and enumerated hosts. ;; GALLIUM used PowerShell for execution to assist in lateral movement as well as for dumping credentials stored on compromised machines. ;; Gallmaker used PowerShell to download additional payloads and for execution. ;; GOLD SOUTHFIELD has staged and executed PowerShell scripts on compromised hosts. ;; Gorgon Group malware can use PowerShell commands to download and execute a payload and open a decoy document on the victim’s machine. ;; GRIFFON has used PowerShell to execute the Meterpreter downloader TinyMet. ;; HAFNIUM has used the Exchange Power Shell module Set-OabVirtualDirectoryPowerShell to export mailbox data. ;; HALFBAKED can execute PowerShell scripts. ;; HAMMERTOSS is known to use PowerShell. ;; Hancitor has used PowerShell to execute commands. ;; One version of Helminth uses a PowerShell script. ;; Inception has used PowerShell to execute malicious commands and payloads. ;; Indrik Spider has used PowerShell Empire for execution of malware. ;; JCry has used PowerShell to execute payloads. ;; KeyBoy uses PowerShell commands to download and execute payloads. ;; KGH_SPY can execute PowerShell commands on the victim's machine. ;; Kimsuky has executed a variety of PowerShell scripts. ;; KONNI used PowerShell to download and execute a specific 64-bit version of the malware. ;; Lazarus Group has used Powershell to download malicious payloads. ;; Leviathan has used PowerShell for execution. ;; Magic Hound has used PowerShell for execution and privilege escalation. ;; menuPass uses PowerSploit to inject shellcode into PowerShell. ;; MoleNet can use PowerShell to set persistence. ;; Molerats used PowerShell implants on target machines. ;; Mosquito can launch PowerShell Scripts. ;; MuddyWater has used PowerShell for execution. ;; Mustang Panda has used malicious PowerShell scripts to enable execution. ;; Netwalker has been written in PowerShell and executed directly in memory avoiding detection. ;; The NETWIRE binary has been executed via PowerShell script. ;; njRAT has executed PowerShell commands via auto-run registry key persistence. ;; OilRig has used PowerShell scripts for execution including use of a macro to run a PowerShell command to decode file contents. ;; Operation Wocao has used PowerShell on compromised systems. ;; OSX_OCEANLOTUS.D uses PowerShell scripts. ;; Patchwork used PowerSploit to download payloads run a reverse shell and execute malware on the victim's machine. ;; Pillowmint has used a PowerShell script to install a shim database. ;; The Poseidon Group's Information Gathering Tool (IGT) includes PowerShell components. ;; POSHSPY uses PowerShell to execute various commands one to execute its payload. ;; PowerShower is a backdoor written in PowerShell. ;; POWERSOURCE is a PowerShell backdoor. ;; PowerSploit modules are written in and executed via PowerShell. ;; PowerStallion uses PowerShell loops to iteratively check for available commands in its OneDrive C2 server. ;; POWERSTATS uses PowerShell for obfuscation and execution. ;; POWERTON is written in PowerShell. ;; POWRUNER is written in PowerShell. ;; PUNCHBUGGY has used PowerShell scripts. ;; Pupy has a module for loading and executing PowerShell scripts. ;; Pysa has used Powershell scripts to deploy its ransomware. ;; QUADAGENT uses PowerShell scripts for execution. ;; There is a variant of RATANKBA that uses a PowerShell script instead of the traditional PE form. ;; RegDuke can extract and execute PowerShell scripts from C2 communications. ;; Revenge RAT uses the PowerShell command Reflection.Assembly to load itself into memory to aid in execution. ;; REvil has used PowerShell to delete volume shadow copies and download files. ;; RogueRobin uses a command prompt to run a PowerShell script from Excel. To assist in establishing persistence RogueRobin creates %APPDATA%\OneDrive.bat and saves the following string to it:powershell.exe -WindowStyle Hidden -exec bypass -File “%APPDATA%\OneDrive.ps1”. ;; Sandworm Team has used PowerShell scripts to run a credential harvesting tool in memory to evade defenses. ;; SeaDuke uses a module to execute Mimikatz with PowerShell to perform Pass the Ticket. ;; ServHelper has the ability to execute a PowerShell script to get information from the infected host. ;; SharpStage can execute arbitrary commands with PowerShell. ;; SHARPSTATS has the ability to employ a custom PowerShell script. ;; Sidewinder has used PowerShell to drop and execute malware loaders. ;; Silence has used PowerShell to download and execute payloads. ;; Socksbot can write and execute PowerShell scripts. ;; SQLRat has used PowerShell to create a Meterpreter session. ;; Stealth Falcon malware uses PowerShell commands to perform various functions including gathering system information via WMI and executing commands from its C2 server. ;; StrongPity can use PowerShell to add files to the Windows Defender exclusions list. ;; TA459 has used PowerShell for execution of a payload. ;; TA505 has used PowerShell to download and execute malware and reconnaissance scripts. ;; TEMP.Veles has used a publicly-available PowerShell-based tool WMImplant. The group has also used PowerShell to perform Timestomping. ;; Threat Group-3390 has used PowerShell for execution. ;; Thrip leveraged PowerShell to run commands to download payloads traverse the compromised networks and carry out reconnaissance. ;; Turla has used PowerShell to execute commands/scripts in some cases via a custom executable or code from Empire's PSInject. Turla has also used PowerShell scripts to load and execute malware in memory. ;; UNC2452 used PowerShell to create new tasks on remote machines identify configuration settings exfiltrate data and to execute other commands. ;; Ursnif droppers have used PowerShell in download cradles to download and execute the malware's full executable payload. ;; Valak has used PowerShell to download additional modules. ;; WellMess can execute PowerShell scripts received from C2. ;; WIRTE has used PowerShell for script execution. ;; Wizard Spider has used macros to execute PowerShell scripts to download malware on victim's machines. It has also used PowerShell to execute commands and move laterally through a victim network. ;; Xbash can use scripts to invoke PowerShell to download a malicious PE executable or PE DLL for execution. ;; Zeus Panda uses PowerShell to download and execute the payload.
name: Command and Scripting Interpreter: Powershell