PowerShell
Named by 136 kept items in this workspace.
82 items name it under classification.technologies, 45 under tools and 9 under affected products.
Search every workspace for PowerShell. It matches the name as written, so it can find other things that share it.
The items that name it 136
Used by the malware to install and start the OpenSSH server on Windows, but it was invoked via /bin/sh, so the step failed
On Windows, installs OpenSSH Server and configures sshd startup
Runs a one-liner from the README that builds a URL on developer-update[.]app and runs the fetched script in memory
affected by the Brotli flaw
living-off-the-land binary invoked by ClickFix commands
hidden process decodes and runs embedded executable; deployment script
PowerShellGet, PSResourceGet
used by the malware for screen capture and staging; obfuscated script aWhXKGlA.ps1
Exchange access path
Used to execute Taskgmr.ps1 and modify config.json, supporting cryptomining and anti-analysis evasion.
Script downloaded and executed via CMD file to download/execute additional ScreenConnect installer and uninstall the first ScreenConnect instance for evasion
Hooked by PsProxy.dll to execute commands without spawning PowerShell.exe.
Recommended for checking Windows hosts for documented host artifacts and the malicious scheduled task
Cmdlets used to set or add MDAV exclusions, e.g. Set-MpPreference -ExclusionPath C:\Temp and Add-MpPreference -ExclusionPath C:\Temp
Abused by threat actor via RMM.Agent.exe service to download and silently install ScreenConnect via Invoke-WebRequest and msiexec.
Used by attackers to execute the ClickFix-delivered obfuscated download/install script (irm download, [scriptblock]::Create execution, msiexec invocation).
Used by malware for download cradles, archive extraction, process execution, and Defender exclusion configuration.
Used by the threat actor to run an encoded command that fetched a loader pulling down three encrypted payloads
Inline-built PowerShell scripts used to decrypt payloads, perform AMSI/UAC bypass, install backdoored ScreenConnect client, and establish persistence/evasion.
Used by attackers via Faronics' deployment functionality to retrieve and execute attacker-controlled scripts from external staging locations such as GitHub
Used by Matt's team to shut down a scam call center's dialer during an investigation.
Used by scammers to have victims connect to a fake 'secure banking server' as part of the scam.
Used across multiple decoded stages to download the ScreenConnect installer, decrypt AES blobs, compile/run the C# UAC bypass exploit, and set SDDL/ACLs
Used with -ExecutionPolicy Bypass to silently run install-time payload from setup.py on pip install
Scripting interpreter abused throughout the chain (hidden window, ExecutionPolicy Bypass) to run L.ps1 and multi-layer decoded loader stages.
Native Windows scripting tool abused by attackers for Living off the Land (LoTL) activity to blend in with normal administration.
Used by the threat actor (base64-encoded) to download scripts, exfiltrate recon data via Invoke-WebRequest, and silently launch batch files with hidden windows and bypassed execution policy.
Built-in Windows scripting/admin tool, cited as commonly abused for living-off-the-land activity
Used by attacker for dropper, builder, and reflective .NET assembly loading scripts throughout the chain
Used to download/install the Komari agent (one-liner iwr from raw.githubusercontent.com) and to run agent-issued exec commands and the uploadBasicInfo collector script
Windows command-line tool abused by attackers to have victims paste and execute malicious commands.
Used to run base64-encoded commands to configure and execute restic/exfiltration and launch ransomware
Encoded PowerShell command executed on victim machines to collect system information and exfiltrate it to the attacker's Elastic instance via hardcoded API key
Used by the attacker for post-exploitation command execution, launched fresh from Explorer for a cleaner process tree
Used by the threat actor for interactive sessions to stage tooling and to download vhost.exe (renamed SimpleHelp binary) via the Net Monitor terminal.
Used extensively across the infection chain for downloading, deobfuscating, and executing multi-stage payloads.
Scripting language used by adversaries (often AI-generated) to build credential dumpers, harvesters, and exfiltration payloads across all four case studies.
Used to add and verify Windows Defender exclusions to evade detection in Incidents 2 and 3.
Used as Stage 2 loader, containing junk code and dynamically decrypting/reflectively loading a .NET assembly
Used by the threat actor via base64-encoded commands (child processes of Velociraptor.exe) to run discovery queries against the compromised endpoint
Audit/Script Block Logging not fully enabled in 231/250 domains; abused via Invoke-Expression/Invoke-Mimikatz
Used to create and manage user accounts on Windows endpoints
Used by the deception feature to execute a signed script (PSScript_{GUID}.ps1) that verifies a SHA256 hash, starts a transcript, and processes a base64-encoded JSON Descriptor parameter containing decoy login details (DetectionKeys, LureDeploymentContext, UserRid, etc.)
Script Block Logging (Event ID 4104), Module Logging (Event ID 4103), and Transcript Logging can be bypassed/spoofed via ScriptBlock Smuggling
used by the malware to download and reflectively load .NET assemblies (second stage and persistence), and used by the analyst for dynamic DLL analysis
Used by new.bat to download DXJS.zip, startuppp.bat, and FTSP.zip, and to extract downloaded ZIP archives
Referenced blog implementing remote session enumeration functionality using the RDS/WTS API
Scripting language used to write the 'cleaner' script analyzed in the post (uses Get-ChildItem, Set-ItemProperty, Remove-Item, Set-NetFirewallRule)
used by malware to establish persistence; Script Block Logging not enabled by default
Aliased via doskey macro to execute commands, e.g. gci (Get-ChildItem), while evading command-line detection
Used for endpoint threat hunting when dedicated tools cannot be installed
Used to run Winlogbeat install script and manage its service
All technologies in this workspace.