← Threat archive

T1059.001 Command and Scripting Interpreter: PowerShell

4 threats tracked by Spectrum Delta use this technique.

T1059.001 on MITRE ATT&CK →

  • n0n credential extortion

    Implant staging via Net.WebClient.DownloadFile to hex HTTPS URLs

    PowerShell script-block logging (4104)

    Seen in: PowerShell script-block logging

  • Yoba signed-AI sideload

    Tasking runs payload from temp exe or hidden ps1

    Sysmon EID 11 (file creation under %TEMP%) + EID 1 (execution of the random-named exe or powershell.exe with the hidden/bypass command line)

    Seen in: Windows file creation, Windows process creation

  • Teams external-chat IT scam

    PowerShell loader execution: hex-array IEX decodes AES-encrypted payload and executes via ScriptBlock

    PowerShell script-block logs: IEX with hex-array decode, AES-decrypt stub with hard-coded key/IV, hash check, ScriptBlock execution; hunt file-create under AppData\Local\PowershellCleaner\scripts (corroborator); the pythonw implant, adsisearcher AD enumeration and .top C2 egress are observed-chain context for scoping once the loader rule fires

    Seen in: PowerShell script-block logs

  • k0t edge-device campaign

    PowerShell-based download of the AdaptixC2 agent installer from staging infrastructure

    Sysmon/EDR process events: PowerShell command lines downloading from the staging IPs/domains; the installer written to disk; beacons to the team-server IPs as corroboration

    Seen in: Windows event logs / Sysmon / EDR