Nishang
Nishang is a collection of PowerShell scripts and payloads used for offensive and post-exploitation activity on Windows systems. The provided content specifically references the Get-PassHashes script, which requires administrative privileges and was used to dump password hashes, and the Invoke-PowerShellTCPOneLine utility, a PowerShell-based reverse shell that initiates a callback to a remote command-and-control server. Detection content notes command-line indicators such as Net.Sockets.TCPClient and System.Text.ASCIIEncoding in PowerShell executions, consistent with remote control or data exfiltration behavior. Nishang activity is mapped to MITRE ATT&CK T1059.001 (PowerShell). In the supplied incident reporting, Nishang was used during a Medusa ransomware intrusion for credential access via Get-PassHashes after attackers had gained access to vulnerable internet-facing infrastructure and conducted broader post-compromise activity including defense evasion, lateral movement, and ransomware deployment. High-confidence indicators from the content include use of Get-PassHashes for password hash dumping and Invoke-PowerShellTCPOneLine for reverse-shell C2 callbacks.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
65 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The following analytic detects the use of the Nishang Invoke-PowerShellTCPOneLine utility, which initiates a callback to a remote Command and Control (C2) server.
The following analytic detects the use of the Nishang Invoke-PowerShellTCPOneLine utility, which initiates a callback to a remote Command and Control (C2) server.
The following analytic detects the use of the Nishang Invoke-PowerShellTCPOneLine utility, which initiates a callback to a remote Command and Control (C2) server.
The following analytic detects the use of the Nishang Invoke-PowerShellTCPOneLine utility, which initiates a callback to a remote Command and Control (C2) server.
The following analytic detects the use of the Nishang Invoke-PowerShellTCPOneLine utility, which initiates a callback to a remote Command and Control (C2) server.
The following analytic detects the use of the Nishang Invoke-PowerShellTCPOneLine utility, which initiates a callback to a remote Command and Control (C2) server.
Techniques & procedures
1 distinct technique documented for this family, organized by ATT&CK tactic.
Execution
1 technique
Execution
Although it is categorized as an Execution technique in the MITRE ATT&CK framework, the T1059.001 PowerShell technique can be used for Defense Evasion. Attackers use PowerShell to: bypassing Antimalware Scan Interface (AMSI) disabling Script Block Logging to prevent detection disabling Windows Defender downloading and running malware payloads in memory executing sophisticated codes without installing extra software injecting malicious code into legitimate processes manipulating access tokens
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Nishang is a PowerShell offensive framework; the Invoke-PowerShellTCPOneLine utility provides a reverse shell/callback to a remote C2 server, enabling remote control and potential data exfiltration.
A PowerShell-based offensive framework whose Get-PassHashes payload was used to dump password hashes during the intrusion.
Nishang is a collection of PowerShell scripts and payloads for penetration testing and red teaming, often used for privilege escalation, persistence, and data exfiltration.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.