CmdID / Techniques / T1059
T1059.001 Command and Scripting Interpreter: PowerShell
Adversaries may abuse PowerShell commands and scripts for execution. MITRE ATT&CK
4 programs on CmdID 103 Sigma rules T1059.001 on attack.mitre.org
Part of
T1059Command and Scripting Interpreter
Programs for it
Sigma rules tagged with it
highDSInternals Suspicious PowerShell CmdletsNasreddine Bencherchali (Nextron Systems), Nounou Mbeiri · Windows
highExchange PowerShell Snap-Ins UsageFPT.EagleEye, Nasreddine Bencherchali (Nextron Systems) · Windows
highHackTool - Covenant PowerShell LauncherFlorian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community · Windows
highHTML Help HH.EXE Suspicious Child ProcessMaxim Pavlunin, Nasreddine Bencherchali (Nextron Systems) · Windows
highInvoke-Obfuscation Obfuscated IEX InvocationDaniel Bohannon (@Mandiant/@FireEye), oscd.community · Windows
highMalicious PowerShell Commandlets - ProcessCreationNasreddine Bencherchali (Nextron Systems) · Windows
highPotential Data Exfiltration Activity Via CommandLine ToolsNasreddine Bencherchali (Nextron Systems) · Windows
highPotential Exploitation of GoAnywhere MFT VulnerabilityMSFT (idea), Swachchhanda Shrawan Poudel (Nextron Systems) · Windows
highPotential Persistence Via Powershell Search Order Hijacking - TaskpH-T (Nextron Systems), Florian Roth (Nextron Systems) · Windows
highPotential PowerShell Command Line ObfuscationTeymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton (fp) · Windows
highPotential PowerShell Obfuscation Via Reversed CommandsTeymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton · Windows
highPotential Powershell ReverseShell ConnectionFPT.EagleEye, wagga, Nasreddine Bencherchali (Nextron Systems) · Windows
highPowerShell Base64 Encoded Invoke KeywordpH-T (Nextron Systems), Harjot Singh, @cyb3rjy0t · Windows
highPowerShell Base64 Encoded Reflective Assembly LoadChristian Burkard (Nextron Systems), pH-T (Nextron Systems) · Windows
highPowerShell Base64 Encoded WMI ClassesChristian Burkard (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · Windows
highPowerShell Dynamic Module Invocation Via ExportedCommands Array IndexNorbert Jaśniewicz (AlphaSOC), Swachchhanda Shrawan Poudel (Nextron Systems) · Windows
highScheduled Task Executing Encoded Payload from RegistrypH-T (Nextron Systems), @Kostastsale, TheDFIRReport, X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · Windows
highSuspicious Encoded And Obfuscated Reflection Assembly Load Function CallpH-T (Nextron Systems) · Windows
highSuspicious Encoded PowerShell Command LineFlorian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community · Windows
highSuspicious PowerShell IEX Execution PatternsFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · Windows
highSuspicious PowerShell Parameter SubstringFlorian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix) · Windows
highSuspicious Schtasks Execution AppData FolderpH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · Windows
highWindows Shell/Scripting Processes Spawning Suspicious ProgramsFlorian Roth (Nextron Systems), Tim Shelton · Windows
mediumCommand Line Execution with Suspicious URL and AppData StringsFlorian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community · Windows
mediumConvertTo-SecureString Cmdlet Usage Via CommandLineTeymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton · Windows
mediumImport PowerShell Modules From Suspicious Directories - ProcCreationNasreddine Bencherchali (Nextron Systems) · Windows
mediumInvocation Of Crypto-Classes From The "Cryptography" PowerShell NamespaceAndreas Braathen (mnemonic.io) · Windows
mediumPotential DLL File Download Via PowerShell Invoke-WebRequestFlorian Roth (Nextron Systems), Hieu Tran · Windows
mediumPotentially Suspicious PowerShell Child ProcessesFlorian Roth (Nextron Systems), Tim Shelton · Windows
mediumPotentially Suspicious Powershell Script Execution From Temp FolderFlorian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton · Windows
mediumPowerShell Download PatternFlorian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro · Windows
mediumPowerShell MSI Install via WindowsInstaller COM From Remote LocationMeroujan Antonyan (vx3r) · Windows
mediumPowerShell Script Run in AppDataFlorian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community · Windows
mediumScheduled Task Executing Payload from RegistryX__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · Windows
mediumSuspicious CrushFTP Child ProcessCraig Sweeney, Matt Anderson, Jose Oregon, Tim Kasper, Faith Stratton, Samantha Shaw, Swachchhanda Shrawan Poudel (Nextron Systems) · Windows
mediumSuspicious XOR Encoded PowerShell CommandSami Ruohonen, Harish Segar, Tim Shelton, Teymur Kheirkhabarov, Vasiliy Burov, oscd.community, Nasreddine Bencherchali · Windows
mediumUsage Of Web Request Commands And CmdletsJames Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger · Windows
lowNon Interactive PowerShell Process SpawnedRoberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements) · Windows
lowPotential Encoded PowerShell Patterns In CommandLineTeymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton · Windows
Command lines CmdID reads as it
Download the contents of a URL to a file on the page for invoke-webrequest
Invoke-WebRequest http://example.com -OutFile path\to\fileIdentifyOnly return raw HTML data instead of parsing it under Internet Explorer (PowerShell 3.0-5.1 only) on the page for invoke-webrequest
Invoke-WebRequest http://example.com -UseBasicParsingIdentifySend form-encoded data (POST request of type application/x-www-form-urlencoded) on the page for invoke-webrequest
Invoke-WebRequest -Method Post -Body @{ name='bob' } http://example.com/formIdentifySend a request with an extra header, using a custom HTTP method on the page for invoke-webrequest
Invoke-WebRequest -Headers @{ X-My-Header = '123' } -Method PUT http://example.comIdentifySend data in JSON format, specifying the appropriate content-type header on the page for invoke-webrequest
Invoke-WebRequest -Body '{"name":"bob"}' -ContentType 'application/json' http://example.com/users/1234IdentifyPass a username and password for server authentication on the page for invoke-webrequest
Invoke-WebRequest -Headers @{ Authorization = "Basic "+ [System.Convert]::ToBase64String([System.Text.Encoding]::ASCII.GetBytes("myusername:mypassword")) } http://example.comIdentifyAdd a computer to a domain using predefined computer credentials on the page for Add-Computer
$newADComputerSplat = @{
Name = "Server02"
AccountPassword = (ConvertTo-SecureString -String 'TempJoinPA$$' -AsPlainText -Force)
}
New-ADComputer @newADComputerSplat
# Then this command is run from Server02 which is not yet domain-joined:
$joinCred = New-Object pscredential -ArgumentList ([pscustomobject]@{
UserName = $null
Password = (ConvertTo-SecureString -String 'TempJoinPA$$' -AsPlainText -Force)[0]
})
$addComputerSplat = @{
DomainName = "Domain03"
Options = 'UnsecuredJoin', 'PasswordPass'
Credential = $joinCred
}
Add-Computer @addComputerSplatIdentifyGet JSON strings from a web service and convert them to PowerShell objects on the page for ConvertFrom-Json
# Ensures that Invoke-WebRequest uses TLS 1.2
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
$j = Invoke-WebRequest 'https://api.github.com/repos/PowerShell/PowerShell/issues' |
ConvertFrom-JsonIdentifyConvert a secure string to an encrypted string on the page for ConvertTo-SecureString
PS C:> $Secure = Read-Host -AsSecureString
PS C:> $Secure
System.Security.SecureString
PS C:> $Encrypted = ConvertFrom-SecureString -SecureString $Secure
PS C:> $Encrypted
01000000d08c9ddf0115d1118c7a00c04fc297eb010000001a114d45b8dd3f4aa11ad7c0abdae98000000000
02000000000003660000a8000000100000005df63cea84bfb7d70bd6842e7efa79820000000004800000a000
000010000000f10cd0f4a99a8d5814d94e0687d7430b100000008bf11f1960158405b2779613e9352c6d1400
0000e6b7bf46a9d485ff211b9b2a2df3bd6eb67aae41
PS C:> $Secure2 = ConvertTo-SecureString -String $Encrypted
PS C:> $Secure2
System.Security.SecureStringIdentifyCreate a secure string from an encrypted string in a file on the page for ConvertTo-SecureString
$Secure = Read-Host -AsSecureString
$Encrypted = ConvertFrom-SecureString -SecureString $Secure -Key (1..16)
$Encrypted | Set-Content Encrypted.txt
$Secure2 = Get-Content Encrypted.txt | ConvertTo-SecureString -Key (1..16)IdentifyConvert a plain text string to a secure string on the page for ConvertTo-SecureString
$Secure_String_Pwd = ConvertTo-SecureString "P@ssW0rD!" -AsPlainText -ForceIdentifyEffects of disabling a session configuration on the page for Disable-PSSessionConfiguration
PS> Get-PSSessionConfiguration | Format-Table -Property Name, Permission -Auto
Name Permission
---- ----------
MaintenanceShell BUILTIN\Administrators AccessAllowed
microsoft.powershell BUILTIN\Administrators AccessAllowed
microsoft.powershell32 BUILTIN\Administrators AccessAllowed
PS> Disable-PSSessionConfiguration -Name MaintenanceShell -Force
PS> Get-PSSessionConfiguration | Format-Table -Property Name, Permission -Auto
Name Permission
---- ----------
MaintenanceShell Everyone AccessDenied, BUILTIN\Administrators AccessAllowed
microsoft.powershell BUILTIN\Administrators AccessAllowed
microsoft.powershell32 BUILTIN\Administrators AccessAllowed
PS> New-PSSession -ComputerName localhost -ConfigurationName MaintenanceShell
[localhost] Connecting to remote server failed with the following error message : Access is denied.
For more information, see the about_Remote_Troubleshooting Help topic.
+ CategoryInfo : OpenError: (System.Manageme....RemoteRunspace:RemoteRunspace) [], PSRemotingTransportException
+ FullyQualifiedErrorId : PSSessionOpenFailedIdentifyAnd 29 more examples on CmdID’s program pages.
An example is here when CmdID’s reading of it names T1059.001: a Sigma rule it trips is tagged with it, or its abuse is documented as it.