Loading malware…
PowerSploit is an open-source PowerShell-based post-exploitation framework for Windows environments. It is composed of modular scripts covering code execution, privilege escalation, persistence, credential access, reconnaissance, and data collection. Its modules are executed through PowerShell and have been widely used both for legitimate security testing and by threat actors as dual-use offensive tooling.
The framework includes capabilities for reflective PE loading and remote process injection, including in-memory execution of DLLs and executables without writing them to disk. It also provides privilege-escalation functionality through the PowerUp module set, including enumeration of token privileges and discovery or exploitation of DLL hijacking opportunities. Persistence options include scheduled tasks and Registry Run-key mechanisms. Credential-access functionality includes modules that search the Windows Registry and related configuration sources for stored credentials. Collection features include keylogging, timed screenshot capture, and access to data from local files, volumes, and processes.
PowerSploit has appeared in intrusion activity associated with multiple threat actors, including MuddyWater, and has been used to support lateral movement and broader post-compromise operations. It has also been reused in malware delivery chains and privilege-escalation workflows, including cases where attackers incorporated individual PowerSploit scripts such as shellcode loaders or reflective injection components into custom tooling. The project was archived in 2021, but its modules remain well known in offensive tradecraft and continue to surface in adversary operations targeting Windows systems.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
17 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
PowerSploit modules are written in and executed via PowerShell.
PowerSploit modules are written in and executed via PowerShell.
PowerSploit modules are written in and executed via PowerShell.
Since the emergence of MuddyWater, we found that its operators used multiple open source post-exploitation tools... PowerSploit
The keb.ps1 script belongs to the popular PowerSploit framework for penetration testing and kicks off a Kerberoasting attack.
APT41 has obtained and used tools such as Mimikatz, pwdump, PowerSploit, and Windows Credential Editor.
25 distinct techniques documented for this family, organized by ATT&CK tactic.
Persistence is different based on the loader used: ... Scheduled task executes a script ... Scheduled task uses LOLBin odbcconf to execute the DLL
The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.
PowerSploit Function: Invoke-ReflectivePEInjection... Reflectively loads a Windows PE file (DLL/EXE) in to the powershell process | Reflectively loads a Windows PE file (DLL/EXE) in to the powershell process, or reflectively injects a DLL in to a remote process.
$Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle...); $Win32Functions.WriteProcessMemory.Invoke(...); Create-RemoteThread -ProcessHandle $RemoteProcHandle -StartAddress $VoidFuncAddr | $VirtualAllocAddr = Get-ProcAddress kernel32.dll VirtualAlloc ... $CreateRemoteThreadAddr = Get-ProcAddress kernel32.dll CreateRemoteThread
Denis exploits a security vulnerability to load a fake DLL and execute its code. Empire contains modules that can discover and exploit various DLL hijacking opportunities. PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit DLL hijacking opportunities in services and processes.
Persistence is different based on the loader used: ... Scheduled task executes a script ... Scheduled task uses LOLBin odbcconf to execute the DLL
The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.
This is probably most useful for injecting backdoors in SYSTEM processes in Session0.
ADVSTORESHELL achieves persistence by adding itself to the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key... APT28 has deployed malware that has copied itself to the startup directory for persistence... FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder.
Persistence is different based on the loader used: ... Scheduled task executes a script ... Scheduled task uses LOLBin odbcconf to execute the DLL
The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.
2.) Reflectively load a DLL in to memory of a remote process. As mentioned above, the DLL being reflectively loaded won't be displayed when tools are used to list DLLs of the running remote process. | Reflectively load a DLL in to memory of a remote process... This is probably most useful for injecting backdoors in SYSTEM processes in Session0.
Refectively load DemoDLL_RemoteProcess.dll in to the lsass process on a remote computer.
The script starts by checking the Windows version and applied hotfixes for the vulnerabilities it is targeting... After selecting the appropriate vulnerability, it uses the PowerSploit module to reflectively load the embedded exploit bundle binary with the target vulnerability and an MSI command as arguments.
This is probably most useful for injecting backdoors in SYSTEM processes in Session0.
ADVSTORESHELL achieves persistence by adding itself to the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key... APT28 has deployed malware that has copied itself to the startup directory for persistence... FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder.
2.) Reflectively load a DLL in to memory of a remote process. As mentioned above, the DLL being reflectively loaded won't be displayed when tools are used to list DLLs of the running remote process. | Reflectively load a DLL in to memory of a remote process... This is probably most useful for injecting backdoors in SYSTEM processes in Session0.
Refectively load DemoDLL_RemoteProcess.dll in to the lsass process on a remote computer.
Remove 'MZ' from the PE file so that it cannot be detected by .imgscan in WinDbg
This tool can be run on remote servers by supplying a local Windows PE file (DLL/EXE) to load in to memory on the remote system, this will load and execute the DLL/EXE in to memory without writing any files to disk.
Denis exploits a security vulnerability to load a fake DLL and execute its code. Empire contains modules that can discover and exploit various DLL hijacking opportunities. PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit DLL hijacking opportunities in services and processes.
OS Credential Dumping: LSASS Memory T1003.001 Basic description The subtechnique known as OS Credential Dumping: LSASS Memory T1003.001 is used by attackers to obtain credentials in a Windows OS.
Technical details | Credential Access TA0006 | OS Credential Dumping: NTDS T1003.003 ... Another popular way to dump ntds.dit is to use the ntdsutil.exe utility.
The content is a catalog of malware families and threat actors that 'can perform keylogging,' 'log keystrokes,' 'capture keystrokes,' or use 'keylogger' modules/tools.
Adversaries may search the Registry on compromised systems for insecurely stored credentials... Example commands to find Registry keys related to password information: Local Machine Hive: reg query HKLM /f password /t REG_SZ /s Current User Hive: reg query HKCU /f password /t REG_SZ /s
Le mode opératoire scanne le réseau pour collecter plus d’informations sur le SI et découvrir des services vulnérables.
Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.
Andariel has collected large numbers of files from compromised network systems for later extraction... APT28 has retrieved internal documents from machines inside victim environments... BADNEWS crawls the victim's local drives and collects documents... many listed groups and malware collect files, documents, credentials, payment card data, or other information from compromised hosts.
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
80 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
PowerShell-based post-exploitation framework referenced as commonly using memory manipulation techniques such as reflective PE injection and shellcode execution.
A PowerShell-based offensive framework mentioned in the context of memory manipulation, reflective PE injection, and shellcode execution techniques.
A PowerShell-based post-exploitation framework that can be downloaded and executed via malicious PowerShell commands.
PowerShell post-exploitation toolkit listed as used by GOLD DRAKE/Evil Corp.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.