PowerSploit
- ID
- S0194
- Type
- Tool
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 17 Apr 2025
PowerSploit is an open source, offensive security framework comprised of PowerShell modules and scripts that perform a wide range of tasks related to penetration testing such as code execution, persistence, bypassing anti-virus, recon, and exfiltration. [1] [2] [3]
Techniques used (28)
- T1003.001 LSASS Memory
- T1005 Data from Local System
- T1012 Query Registry
- T1027.005 Indicator Removal from Tools
- T1027.010 Command Obfuscation
- T1047 Windows Management Instrumentation
- T1053.005 Scheduled Task
- T1055.001 Dynamic-link Library Injection
- T1056.001 Keylogging
- T1057 Process Discovery
- T1059.001 PowerShell
- T1087.001 Local Account
- T1113 Screen Capture
- T1123 Audio Capture
- T1134 Access Token Manipulation
- T1482 Domain Trust Discovery
- T1543.003 Windows Service
- T1547.001 Registry Run Keys / Startup Folder
- T1547.005 Security Support Provider
- T1552.002 Credentials in Registry
- T1552.006 Group Policy Preferences
- T1555.004 Windows Credential Manager
- T1558.003 Kerberoasting
- T1574.001 DLL
- T1574.007 Path Interception by PATH Environment Variable
- T1574.008 Path Interception by Search Order Hijacking
- T1574.009 Path Interception by Unquoted Path
- T1620 Reflective Code Loading
Groups using it (9)
- G0040 Patchwork
- G0045 menuPass
- G0046 FIN7
- G0064 APT33
- G0065 Leviathan
- G0069 MuddyWater
- G0092 TA505
- G0096 APT41
- G1006 Earth Lusca