CyberStack

MITRE ATT&CK / Techniques / T1059.001

Command and Scripting Interpreter: PowerShell

ID
T1059.001
Tactics
TA0002 Execution
Sub-technique of
T1059 Command and Scripting Interpreter
Platforms
Windows, Linux, macOS
Data sources
Process Creation, Command Execution, Process Metadata, Module Load
Source
attack.mitre.org
MITRE last modified
18 Sep 2026

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.[4] PowerShell can also be installed on Linux and macOS.[5] Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the Start-Process cmdlet which can be used to run an executable and the Invoke-Command cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).

PowerShell may also be used to download and run executables from the Internet, which can be executed from disk or in memory without touching disk.

A number of PowerShell-based offensive testing tools are available, including Empire, PowerSploit, PoshC2, and PSAttack.[6]

PowerShell commands/scripts can also be executed without directly invoking the powershell.exe binary through interfaces to PowerShell's underlying System.Management.Automation assembly DLL exposed through the .NET framework and Windows Common Language Interface (CLI).[7][8][9]

Detection

Mitigations (5)

M1026 Privileged Account Management

When PowerShell is necessary, consider restricting PowerShell execution policy to administrators. Be aware that there are methods of bypassing the PowerShell execution policy, depending on environment configuration.[1]

PowerShell JEA (Just Enough Administration) may also be used to sandbox administration and limit what commands admins/users can execute through remote PowerShell sessions.[2]

M1038 Execution Prevention

Use application control where appropriate. PowerShell Constrained Language mode can be used to restrict access to sensitive or otherwise dangerous language elements such as those used to execute arbitrary Windows APIs or files (e.g., Add-Type).[3]

M1042 Disable or Remove Feature or Program

It may be possible to remove PowerShell from systems when not needed, but a review should be performed to assess the impact to an environment, since it could be in use for many legitimate purposes and administrative functions.

Disable/restrict the WinRM Service to help prevent uses of PowerShell for remote execution.

M1045 Code Signing

Set PowerShell execution policy to execute only signed scripts.

M1049 Antivirus/Antimalware

Anti-virus can be used to automatically quarantine suspicious files.

Groups (86)

Showing 60 of 86. Full list on attack.mitre.org.

Software (133)

Showing 60 of 133. Full list on attack.mitre.org.

References

  1. Netspi PowerShell Execution Policy Bypass
  2. Microsoft PS JEA
  3. Microsoft PowerShell CLM
  4. TechNet PowerShell
  5. Powershell installation
  6. Github PSAttack
  7. Sixdub PowerPick Jan 2016
  8. SilentBreak Offensive PS Dec 2015
  9. Microsoft PSfromCsharp APR 2014