T1059.001 PowerShell in MITRE ATT&CK Explained

What Is T1059.001 PowerShell in MITRE ATT&CK?

T1059.001 PowerShell is a sub-technique of the Command and Scripting Interpreter (T1059) technique in the MITRE ATT&CK framework, which falls under the Execution tactic. It refers to the use of PowerShell, a powerful built-in Windows command-line shell and scripting environment, by adversaries to execute malicious code and perform a wide range of actions during an attack.

PowerShell is included by default in Windows and provides deep access to system internals, making it attractive both for legitimate administration and for abuse by attackers. Adversaries may leverage PowerShell to run commands, launch scripts, discover system information, download and execute payloads, and interact with remote systems, often without writing files to disk.

Because it is trusted and widely deployed, adversarial use of PowerShell can blend in with normal system activity, helping attackers achieve objectives such as execution, persistence, lateral movement, and defense evasion.

To read about other sub-techniques of the T1059 Command and Scripting Interpreter technique, you can visit the related hub blog.

Adversary Use of T1059.001 PowerShell

Adversaries frequently avoid installing and utilizing third-party programs on compromised hosts. Such actions can readily trigger correlated alerts in SIEM products or leave traces of their presence on the system.

To evade detection and execute stealthy attacks, adversaries often use built-in command-line and scripting utilities rather than third-party programs for executing their commands. PowerShell is one of these native built-in tools commonly observed in adversaries' arsenals.

Procedure Examples Used by Adversaries in Red Report 2026

Adversaries frequently leverage PowerShell to support multiple stages of an attack, taking advantage of its native availability and deep access to Windows systems.

In the Red Report 2026 dataset, PowerShell is commonly observed facilitating execution, persistence, and follow-on activity.

Persistence via Registry Run Keys (MITRE T1547.001)

Adversaries commonly obtain persistence by configuring programs or scripts to run automatically at system boot or user logon. In a March 2025 analysis of HellCat ransomware, Picus observed a multi-stage PowerShell chain that creates a persistent Run-key and fetches follow-on payloads from attacker infrastructure [1].

What it does

• Locates the full path to powershell.exe and builds a hidden execution command.
• Uses Invoke-WebRequest to download remote .ps1 content and creates scriptblocks from the downloaded text for in-memory execution.
• Writes the constructed command into HKCU\Software\Microsoft\Windows\CurrentVersion\Run as the value named maintenance, so Windows executes that command at each user logon.
• On each logon the Run-key command executes, re-contacting the attacker host to download and run subsequent stages.

This method ensures that every time the compromised user logs in, the PowerShell chain re-executes, re-establishing contact with the attacker infrastructure to fetch additional payloads.

Disabling or Modifying Tools for Evasion (MITRE T1562.001)

Adversaries disable, alter or otherwise interfere with security products and tooling to avoid detection and prolong access.

In a November 2025 analysis of ValleyRAT by Picus Security, the malware injects a PowerShell command to add a Defender exclusion for the drive the malware resides on [2]:

The injected command calls Add-MpPreference -ExclusionPath "<drive>:\\", which programmatically adds the specified path to Microsoft Defender's exclusion list. Once an exclusion is registered, Defender skips real-time scanning of files and processes under that path, allowing the malware to run and persist without being flagged by signatures or behavioral detections.

The injection is executed via a remote shell mechanism (PowerShell Invoke-Command) so the attacker can perform the change remotely and silently; the debug string ("RC|WinDefend") indicates the code path targeting Defender. Because Defender exclusions are applied at the Defender configuration level, this evasion removes one of the primary detection controls rather than merely disabling a single process.

Downloading and Executing Malicious Payloads

Adversaries use PowerShell one-liners to decode, deobfuscate and execute payloads directly in memory, avoiding disk-based artifacts and common AV/EDR signatures.

In a July 2025 analysis of Chihuahua Stealer by Picus Security, a sample launched a compact PowerShell command that decodes a Base64 payload and executes it in memory [3]:

The one-liner runs PowerShell with elevated privileges (RunAs) and suppresses UI and profile loading (-windowstyle hidden -nologo -noprofile). It sets ExecutionPolicy to bypass, then calls FromBase64String() to decode an embedded Base64 blob into bytes and converts those bytes to a UTF-8 string. Finally, iex (Invoke-Expression) executes the resulting script directly in the PowerShell process memory.

Because the payload is decoded and executed in-memory, the technique leaves minimal or no files on disk, reduces I/O artifacts, and can bypass signature-based detection that scans file contents.

Procedure Examples Used by Adversaries in Red Report 2025

Downloading and Executing Malicious Payloads

PowerShell's versatility as a command and scripting framework makes it a prime target for malicious exploitation, particularly exemplified by the Pioneer Kitten threat group's activities observed in August 2024 [4]:

• The Invoke-WebRequest cmdlet is used to make HTTP or HTTPS requests to specified URLs.
• Here, the -Uri parameter directs PowerShell to access the URL hxxp://files[.]catbox[.]moe, a site that hosts malicious payloads.
• The -OutFile parameter specifies the location and name of the downloaded file, saving it to the public directory (C:\Users\Public\) as "malware.exe." This allows the attackers to discreetly deliver their payload onto the targeted system.

In addition, adversaries often combine this technique with Windows PowerShell Web Access to execute commands remotely on compromised servers. This combination enables them to maintain control over systems, deploy further payloads, or exfiltrate data.

In another example, a phishing campaign analyzed by Cisco Talos in October 2024 involving the delivery of new PowerRAT malware revealed how adversaries employed PowerShell to execute malicious activities on compromised systems [5]. When a victim opens a malicious Microsoft Word document and enables its content, an embedded Visual Basic for Applications (VBA) macro is triggered. This macro decodes hidden Base64-encoded data within the document, extracting two components: a malicious HTML Application (HTA) file and a PowerShell loader script.

The macro saves these components to the user's profile directory and modifies the Windows registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LOAD to automatically execute the HTA file upon user login. When the system restarts, the HTA file runs, invoking the PowerShell loader script, which subsequently loads and executes the PowerRAT malware directly into memory.

This sequence demonstrates how adversaries leverage PowerShell's capabilities to facilitate fileless malware execution, thereby evading traditional detection mechanisms.

Impair Defenses (ATT&CK T1562)

PowerShell is a favored tool among adversaries for its robust capabilities and seamless integration with the Windows operating system, allowing them to execute malicious operations, including disabling critical security features. Its versatility and scripting power make it a prime target for abuse in attacks.

One illustrative example, reported in November 2024, is a PowerShell-based script attributed to the BianLian ransomware group [6], which demonstrates a technique to disable Windows' Antimalware Scan Interface (AMSI), a core defense mechanism for detecting and preventing script-based malware execution.

The script leverages .NET reflection to bypass AMSI, as shown below:

This script exploits PowerShell's reflective capabilities to dynamically access the System.Management.Automation.AmsiUtils class and manipulate the private static field amsiInitFailed. This field tracks AMSI's initialization state, and by setting it to true, the script effectively disables AMSI, marking it as non-functional. With AMSI bypassed, malicious scripts can execute without being inspected or flagged, evading detection by antivirus and endpoint protection solutions.

Another example, highlighted in a DFIR report released in August 2024, involves the exploitation of PowerShell by command-and-control frameworks such as Sliver and PoshC2 [7]. These frameworks use the following commands to manipulate essential security services on Windows systems:

These commands sequentially disable the Windows Defender feature, restart the Windows Defender service, and forcibly restart the Windows Firewall service. Such actions not only disrupt the built-in security mechanisms but also leave the system vulnerable to further exploitation, enabling attackers to maintain persistence and execute malicious activities undetected.

Again, in our final example, a report released by CISA in November 2024 highlights the tactics employed by Black Basta ransomware affiliates. The attackers leveraged Powershell scripting to disable Endpoint Detection and Response (EDR) tooling. By neutralizing these critical defense mechanisms, the affiliates successfully evaded detection, maintained persistence, and facilitated the execution of their ransomware payloads.

These examples underscore the increasing sophistication of ransomware groups and the necessity for robust defenses capable of detecting and mitigating such targeted attacks.

Obfuscated Files or Information (ATT&CK T1027)

Adversaries frequently leverage PowerShell in their campaigns, exploiting its capabilities for obfuscation and deobfuscation to seamlessly conceal and execute malicious scripts. A notable example is the PowerShell decryptor employed in the CoralRaider campaign [8], a critical component of a multi-stage infection chain designed to deliver malware payloads while evading detection.

In this campaign analyzed in April 2024, the PowerShell decryptor script is embedded within an obfuscated HTML Application (HTA) file. Upon execution, it decrypts an AES-encrypted block of data using a 256-byte key derived from a base64-encoded string and a 16-byte initialization vector (IV) set to all zeros [8]. This step unpacks the next-stage PowerShell loader script, which operates entirely in memory, minimizing detectable artifacts.

The loader script then performs several malicious functions, including bypassing User Account Control (UAC) protections by abusing legitimate Windows binaries like FoDHelper.exe. It also modifies registry settings and adds specific directories to the Windows Defender exclusion list, ensuring the persistence and undetected execution of subsequent stages.

Ultimately, the campaign downloads and executes information stealers such as CryptBot, LummaC2, or Rhadamanthys. By combining encryption, obfuscation, and the use of trusted system processes, the PowerShell decryptor establishes a stealthy and efficient malware delivery mechanism, making it difficult for traditional security defenses to detect or analyze the attack.

Publicly Available PowerShell Tools Utilized by Threat Actors

PowerShell's extensive capabilities have made it a favored tool among red teamers and penetration testers, leading to the creation of powerful, publicly available frameworks and tools for red teaming and penetration testing. Prominent examples include Empire [9] for post-exploitation tactics, PowerSploit [10] for security testing, Nishang [11] with varied attack functionalities, PoshC2 [12] for server administration and post-exploitation, and Posh-SecMod [13] offering security and forensic tools.

Validate Your Defenses Against the Red Report 2026 Threats

References

[1] S. Ö. Hacıoğlu, “HellCat Ransomware: Exposing the TTPs of a Rising Ransomware Threat in 2025,” Mar. 13, 2025. Available: https://www.picussecurity.com/resource/blog/hellcat-ransomware. [Accessed: Nov. 04, 2025]

[2] S. Ö. Hacıoğlu, “Dissecting ValleyRAT: From Loader to RAT Execution in Targeted Campaigns,” Nov. 05, 2025. Available: https://www.picussecurity.com/resource/blog/dissecting-valleyrat-from-loader-to-rat-execution-in-targeted-campaigns. [Accessed: Nov. 05, 2025]

[3] S. Ö. Hacıoğlu, “Chihuahua Stealer Malware Targets Browser and Wallet Data,” May 23, 2025. Available: https://www.picussecurity.com/resource/blog/chihuahua-stealer-malware-targets-browser-and-wallet-data. [Accessed: Nov. 05, 2025]

[4] S. Özeren, “Pioneer Kitten: Iranian Threat Actors Facilitate Ransomware Attacks Against U.S. Organizations,” Aug. 28, 2024. Available: https://www.picussecurity.com/resource/blog/pioneer-kitten-cisa-alert-aa24-241a. [Accessed: Nov. 26, 2024]

[5] C. Raghuprasad, “Threat actor abuses Gophish to deliver new PowerRAT and DCRAT,” Cisco Talos Blog, Oct. 22, 2024. Available: https://blog.talosintelligence.com/gophish-powerrat-dcrat/. [Accessed: Nov. 26, 2024]

[6] “#StopRansomware: BianLian Ransomware Group,” Cybersecurity and Infrastructure Security Agency CISA. Available: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-136a. [Accessed: Dec. 19, 2023]

[7] “Threat Actors’ Toolkit: Leveraging Sliver, PoshC2 & Batch Scripts,” The DFIR Report, Aug. 12, 2024. Available: https://thedfirreport.com/2024/08/12/threat-actors-toolkit-leveraging-sliver-poshc2-batch-scripts/. [Accessed: Nov. 26, 2024]

[8] C. Talos, “Suspected CoralRaider continues to expand victimology using three information stealers,” Cisco Talos Blog, Apr. 23, 2024. Available: https://blog.talosintelligence.com/suspected-coralraider-continues-to-expand-victimology-using-three-information-stealers/. [Accessed: Nov. 26, 2024]

[9] “Empire/Invoke-TokenManipulation.ps1 at master · EmpireProject/Empire,” GitHub. Available: https://github.com/EmpireProject/Empire. [Accessed: Dec. 12, 2022]

[10] “GitHub - PowerShellMafia/PowerSploit: PowerSploit - A PowerShell Post-Exploitation Framework,” GitHub. Available: https://github.com/PowerShellMafia/PowerSploit. [Accessed: Dec. 13, 2022]

[11] “GitHub - samratashok/nishang: Nishang - Offensive PowerShell for red team, penetration testing and offensive security,” GitHub. Available: https://github.com/samratashok/nishang. [Accessed: Dec. 13, 2022]

[12] “PoshC2,” Nettitude Labs, Jun. 20, 2016. Available: https://labs.nettitude.com/tools/poshc2/. [Accessed: Dec. 13, 2022]

[13] “GitHub - darkoperator/Posh-SecMod: PowerShell Module with Security cmdlets for security work,” GitHub. Available: https://github.com/darkoperator/Posh-SecMod. [Accessed: Dec. 13, 2022]