Wiki › Techniques, Tactics & Procedures (TTPs) › Execution › PowerShell-Based Execution

PowerShell-Based Execution

2 min read

Jump to:

Overview

PowerShell-Based Execution is a technique where adversaries leverage the Windows PowerShell scripting environment to execute malicious code or commands. This method plays a critical role in the attack lifecycle by enabling attackers to run payloads directly in memory, often bypassing traditional executable file detection. Its flexibility and integration with the Windows operating system make it a favored tool for executing a wide range of malicious activities.

Attack Objective

Execute arbitrary code or commands to gain control or perform actions on a target system
Supports multiple stages including Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Lateral Movement, Command & Control, and Exfiltration
Advances the attacker’s position by enabling stealthy and flexible execution of payloads without relying on dropped files

How the Technique Works

Adversaries use PowerShell to run scripts or commands that can download, decode, and execute malicious payloads directly in memory. This can include invoking system utilities, manipulating the environment, or interacting with other processes. Because PowerShell is a legitimate administrative tool, its use can blend with normal system activity, complicating detection efforts.

Common Methods & Variations

Execution of encoded or obfuscated PowerShell commands via command-line interfaces or scripts
Use in both on-premises and cloud environments to interact with local or remote systems
Living-off-the-land approach leveraging native PowerShell capabilities versus deploying custom malicious scripts or modules

Indicators of Compromise (IOCs)

Unusual PowerShell process creation events, especially with encoded or obfuscated command-line arguments
Network connections initiated by PowerShell processes to suspicious external endpoints
Execution of PowerShell scripts from non-standard locations or by unexpected users
Logs showing PowerShell activity outside normal operational patterns

Detection Strategies

Monitoring PowerShell script block logging and transcription features
Behavioral detection focusing on anomalous PowerShell command-line parameters and process behaviors
Correlation of PowerShell activity with other suspicious events such as network connections or privilege escalations

Mitigation & Prevention

Implement application whitelisting to restrict unauthorized PowerShell script execution
Enforce constrained language mode and disable unnecessary PowerShell features
Apply least privilege principles to limit user and process permissions for executing PowerShell
Regularly update and patch PowerShell and the operating system to address vulnerabilities

Response Considerations

Immediately isolate affected systems to prevent further execution or lateral movement
Collect and analyze PowerShell logs, command-line arguments, and associated network activity for investigation
Remove or quarantine malicious scripts and harden PowerShell configurations to prevent recurrence

Related Techniques

Command and Scripting Interpreter techniques involving other scripting environments
Process Injection methods used in conjunction with PowerShell execution
Credential Access and Lateral Movement techniques that leverage PowerShell for propagation

Mapping & References

MITRE ATT&CK T1059.001 – Command and Scripting Interpreter: PowerShell
Public advisories and research on PowerShell abuse in cyber attacks from cybersecurity vendors and CERTs

Tags: Attack Technique Cybersecurity Execution Incident Response Living-off-the-Land PowerShell Threat Detection threat mitigation TTP Windows Security