S0194: PowerSploit

PowerSploit matters because it packages many post-compromise actions into PowerShell modules on Windows: execution, persistence, antivirus bypass, reconnaissance, credential-oriented activity, collection, and exfiltration-related tasks. For leaders, the decision value is not whether the tool name appears in alerts, but whether the organization can reliably see and investigate suspicious PowerShell-driven behavior across endpoints before it becomes broader credential theft, persistence, or data collection.

Executive priority

Prioritize this as a Windows endpoint visibility and response-readiness issue. ATT&CK links PowerSploit to multiple campaigns and groups, and the tool maps to behaviors that affect incident scope decisions: LSASS memory access, WMI execution, scheduled tasks, registry querying, keylogging, process discovery, account discovery, screen capture, and data collection. Executives should ask whether SOC and IR teams can prove collection of PowerShell, process, credential-access, and persistence telemetry, and whether legitimate administration or red-team use is governed well enough to avoid blind spots.

Technical view

PowerSploit is an open-source PowerShell post-exploitation framework. ATT&CK does not provide a detection section for this object, so validation should be behavior-led using the related techniques: T1059.001 PowerShell, T1047 WMI, T1053.005 Scheduled Task, T1003.001 LSASS Memory, T1012 Query Registry, T1055.001 DLL Injection, T1056.001 Keylogging, T1057 Process Discovery, T1087.001 Local Account, T1113 Screen Capture, T1005 Data from Local System, and T1027.005/T1027.010 obfuscation and tool modification. Detection engineering should avoid depending only on static PowerSploit strings because the framework is open source and the ATT&CK relationships include obfuscation and indicator removal behaviors.

Likely telemetry

PowerShell execution records, including script content where available, command lines, module activity, and encoded or obfuscated command indicators
Windows process creation and parent-child process relationships involving PowerShell, WMI, scheduled task utilities, and administrative shells
WMI activity and remote/local command execution evidence
Scheduled task creation, modification, and execution events
Windows Registry query activity relevant to discovery

Detection direction

Build coverage around behaviors mapped to the related ATT&CK techniques rather than only the PowerSploit name or repository-derived signatures.
Tune for suspicious PowerShell patterns: unusual parents, encoded or obfuscated commands, script execution from user-writable paths, and PowerShell followed by discovery, credential access, persistence, or collection activity.
Correlate PowerShell with WMI execution, scheduled task creation, registry queries, process/account discovery, LSASS access, screen capture, and local data collection to improve fidelity.
Account for legitimate security testing and administrative PowerShell use; require change records or test windows so approved PowerSploit-like activity does not normalize real intrusions.
Review blind spots caused by missing script block visibility, disabled command-line logging, endpoint-only detections without central retention, and detections that rely on static indicators despite ATT&CK-linked obfuscation and indicator-removal techniques.

Mitigation priorities

Establish governance for authorized PowerShell and penetration-testing frameworks, including approval, logging requirements, and post-test cleanup evidence.
Harden PowerShell execution where operationally feasible and ensure administrative use is auditable on Windows endpoints.
Prioritize endpoint controls and monitoring for credential-access behaviors, especially LSASS memory access, because related techniques can materially affect lateral movement and incident scope.
Monitor and restrict persistence mechanisms such as scheduled tasks where business use does not justify broad creation rights.
Ensure SOC and IR playbooks cover PowerShell-led investigations, including triage of WMI, scheduled tasks, registry discovery, process/account discovery, collection, and screen capture evidence.

Analyst notes and limits

ATT&CK identifies PowerSploit as an open-source offensive security framework made of PowerShell modules and scripts. Relationship context shows use by campaigns and groups including CostaRicto, Operation Wocao, Patchwork, menuPass, FIN7, APT33, Leviathan, MuddyWater, TA505, APT41, and Earth Lusca, and maps the tool to multiple execution, persistence, discovery, credential access, collection, privilege escalation, and stealth techniques. This supports a behavior-focused defensive take, not an attribution conclusion.

The official ATT&CK object provides no dedicated detection guidance and no tactics directly on the tool object. Local conclusions require environment-specific telemetry, authorized-use records, endpoint logging configuration, and IR evidence. The presence of PowerShell activity alone is not sufficient to identify PowerSploit or malicious use.

Official MITRE ATT&CK definition

PowerSploit

PowerSploit is an open source, offensive security framework comprised of PowerShell modules and scripts that perform a wide range of tasks related to penetration testing such as code execution, persistence, bypassing anti-virus, recon, and exfiltration. [1] [2] [3]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques 28 rows

Domain	ID	Name	Relationship / procedure
Enterprise	T1574.007	Path Interception by PATH Environment Variable Sub-technique	PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit path interception opportunities in the PATH environment variable.CitationGitHub PowerSploit May 2012CitationPowerSploit Documentation
Enterprise	T1056.001	Keylogging Sub-technique	PowerSploit's `Get-Keystrokes` Exfiltration module can log keystrokes.CitationGitHub PowerSploit May 2012CitationPowerSploit Documentation
Enterprise	T1620	Reflective Code Loading	PowerSploit reflectively loads a Windows PE file into a process.CitationGitHub PowerSploit May 2012CitationPowerSploit Documentation
Enterprise	T1552.002	Credentials in Registry Sub-technique	PowerSploit has several modules that search the Windows Registry for stored credentials: `Get-UnattendedInstallFile`, `Get-Webconfig`, `Get-ApplicationHost`, `Get-SiteListPassword`, `Get-CachedGPPPassword`, and `Get-RegistryAutoLogon`.CitationPentestlab Stored Credentials
Enterprise	T1027.005	Indicator Removal from Tools Sub-technique	PowerSploit's `Find-AVSignature` AntivirusBypass module can be used to locate single byte anti-virus signatures.CitationGitHub PowerSploit May 2012CitationPowerSploit Documentation
Enterprise	T1123	Audio Capture	PowerSploit's `Get-MicrophoneAudio` Exfiltration module can record system microphone audio.CitationGitHub PowerSploit May 2012CitationPowerSploit Documentation
Enterprise	T1047	Windows Management Instrumentation	PowerSploit's `Invoke-WmiCommand` CodeExecution module uses WMI to execute and retrieve the output from a PowerShell payload.CitationGitHub PowerSploit May 2012CitationPowerSploit Documentation
Enterprise	T1574.009	Path Interception by Unquoted Path Sub-technique	PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit unquoted path vulnerabilities.CitationGitHub PowerSploit May 2012CitationPowerSploit Documentation
Enterprise	T1012	Query Registry	PowerSploit contains a collection of Privesc-PowerUp modules that can query Registry keys for potential opportunities.CitationGitHub PowerSploit May 2012CitationPowerSploit Documentation
Enterprise	T1005	Data from Local System	PowerSploit contains a collection of Exfiltration modules that can access data from local files, volumes, and processes.CitationGitHub PowerSploit May 2012CitationPowerSploit Documentation
Enterprise	T1552.006	Group Policy Preferences Sub-technique	PowerSploit contains a collection of Exfiltration modules that can harvest credentials from Group Policy Preferences.CitationGitHub PowerSploit May 2012CitationPowerSploit Documentation
Enterprise	T1055.001	Dynamic-link Library Injection Sub-technique	PowerSploit contains a collection of CodeExecution modules that inject code (DLL, shellcode) into a process.CitationGitHub PowerSploit May 2012CitationPowerSploit Documentation
Enterprise	T1027.010	Command Obfuscation Sub-technique	PowerSploit contains a collection of ScriptModification modules that compress and encode scripts and payloads.CitationGitHub PowerSploit May 2012CitationPowerSploit Documentation
Enterprise	T1134	Access Token Manipulation	PowerSploit's `Invoke-TokenManipulation` Exfiltration module can be used to manipulate tokens.CitationGitHub PowerSploit May 2012CitationPowerSploit Documentation
Enterprise	T1543.003	Windows Service Sub-technique	PowerSploit contains a collection of Privesc-PowerUp modules that can discover and replace/modify service binaries, paths, and configs.CitationGitHub PowerSploit May 2012CitationPowerSploit Documentation
Enterprise	T1113	Screen Capture	PowerSploit's `Get-TimedScreenshot` Exfiltration module can take screenshots at regular intervals.CitationGitHub PowerSploit May 2012CitationPowerSploit Documentation
Enterprise	T1547.001	Registry Run Keys / Startup Folder Sub-technique	PowerSploit's `New-UserPersistenceOption` Persistence argument can be used to establish via the `HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run` Registry key.CitationGitHub PowerSploit May 2012CitationPowerSploit Documentation
Enterprise	T1053.005	Scheduled Task Sub-technique	PowerSploit's `New-UserPersistenceOption` Persistence argument can be used to establish via a Scheduled Task/Job.CitationGitHub PowerSploit May 2012CitationPowerSploit Documentation
Enterprise	T1574.001	DLL Sub-technique	PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit DLL hijacking opportunities in services and processes.CitationGitHub PowerSploit May 2012CitationPowerSploit Documentation
Enterprise	T1574.008	Path Interception by Search Order Hijacking Sub-technique	PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit search order hijacking vulnerabilities.CitationGitHub PowerSploit May 2012CitationPowerSploit Documentation
Enterprise	T1558.003	Kerberoasting Sub-technique	PowerSploit's `Invoke-Kerberoast` module can request service tickets and return crackable ticket hashes.CitationPowerSploit Invoke KerberoastCitationHarmj0y Kerberoast Nov 2016
Enterprise	T1087.001	Local Account Sub-technique	PowerSploit's `Get-ProcessTokenGroup` Privesc-PowerUp module can enumerate all SIDs associated with its current token.CitationGitHub PowerSploit May 2012CitationPowerSploit Documentation
Enterprise	T1547.005	Security Support Provider Sub-technique	PowerSploit's `Install-SSP` Persistence module can be used to establish by installing a SSP DLL.CitationGitHub PowerSploit May 2012CitationPowerSploit Documentation
Enterprise	T1057	Process Discovery	PowerSploit's `Get-ProcessTokenPrivilege` Privesc-PowerUp module can enumerate privileges for a given process.CitationGitHub PowerSploit May 2012CitationPowerSploit Documentation
Enterprise	T1555.004	Windows Credential Manager Sub-technique	PowerSploit contains a collection of Exfiltration modules that can harvest credentials from Windows vault credential objects.CitationGitHub PowerSploit May 2012CitationPowerSploit Documentation
Enterprise	T1059.001	PowerShell Sub-technique	PowerSploit modules are written in and executed via PowerShell.CitationGitHub PowerSploit May 2012CitationPowerSploit Documentation
Enterprise	T1482	Domain Trust Discovery	PowerSploit has modules such as `Get-NetDomainTrust` and `Get-NetForestTrust` to enumerate domain and forest trusts.CitationGitHub PowerSploit May 2012CitationPowerSploit Documentation
Enterprise	T1003.001	LSASS Memory Sub-technique	PowerSploit contains a collection of Exfiltration modules that can harvest credentials using Mimikatz.CitationGitHub PowerSploit May 2012CitationPowerSploit Documentation

Associated objects

Groups, software, and campaigns

G0064: APT33

APT33 is a suspected Iranian threat group that has carried out operations since at least 2013. The group has targeted organizations across multiple industries in the United States, Saudi Arabia, and South Korea, with a particular interest in the aviation and energy sectors.[1][2]

G1006: Earth Lusca

Earth Lusca is a suspected China-based cyber espionage group that has been active since at least April 2019. Earth Lusca has targeted organizations in Australia, China, Hong Kong, Mongolia, Nepal, the Philippines, Taiwan, Thailand, Vietnam, the United Arab Emirates, Nigeria, Germany, France, and the United States. Targets included government institutions, news media outlets, gambling companies, educational institutions, COVID-19 research organizations, telecommunications companies, religious movements banned in China, and cryptocurrency trading platforms; security researchers assess some Earth Lusca operations may be financially motivated.[1]

Earth Lusca has used malware commonly used by other Chinese threat groups, including APT41 and the Winnti Group cluster, however security researchers assess Earth Lusca's techniques and infrastructure are separate.[1]

G0096: APT41

APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, APT41 has been observed targeting various industries, including but not limited to healthcare, telecom, technology, finance, education, retail and video game industries in 14 countries.[1] Notable behaviors include using a wide range of malware and tools to complete mission objectives. APT41 overlaps at least partially with public reporting on groups including BARIUM and Winnti Group.[2][3]

G0069: MuddyWater

MuddyWater is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS).[1] Since at least 2017, MuddyWater has targeted a range of government and private organizations across sectors, including telecommunications, local government, finance, defense, and oil and natural gas organizations, in the Middle East (specifically the UAE and Saudi Arabia), Asia, Africa, Europe, and North America. MuddyWater has reused domains dating back to October 2025, and has a preference for NameCheap and Hosterdaddy Private Limited (AS136557). In late 2025 and early 2026, MuddyWater used commercial satellite internet (i.e., Starlink) for command and control (C2) communication. [2][3][4][5][6][7][8][9][10][11][12][13]

G0046: FIN7

FIN7 is a financially-motivated threat group that has been active since 2013. FIN7 has targeted the retail, restaurant, hospitality, software, consulting, financial services, medical equipment, cloud services, media, food and beverage, transportation, pharmaceutical, and utilities industries in the United States. A portion of FIN7 was operated out of a front company called Combi Security and often used point-of-sale malware for targeting efforts. Since 2020, FIN7 shifted operations to big game hunting (BGH), including use of REvil ransomware and their own Ransomware-as-a-Service (RaaS), Darkside. FIN7 may be linked to the Carbanak Group, but multiple threat groups have been observed using Carbanak, leading these groups to be tracked separately.[1][2][3][4][5][6][7]

G0045: menuPass

menuPass is a threat group that has been active since at least 2006. Individual members of menuPass are known to have acted in association with the Chinese Ministry of State Security's (MSS) Tianjin State Security Bureau and worked for the Huaying Haitai Science and Technology Development Company.[1][2]

menuPass has targeted healthcare, defense, aerospace, finance, maritime, biotechnology, energy, and government sectors globally, with an emphasis on Japanese organizations. In 2016 and 2017, the group is known to have targeted managed IT service providers (MSPs), manufacturing and mining companies, and a university.[3][4][5][6][7][1][2]

G0065: Leviathan

Leviathan is a Chinese state-sponsored cyber espionage group that has been attributed to the Ministry of State Security's (MSS) Hainan State Security Department and an affiliated front company.[1] Active since at least 2009, Leviathan has targeted the following sectors: academia, aerospace/aviation, biomedical, defense industrial base, government, healthcare, manufacturing, maritime, and transportation across the US, Canada, Australia, Europe, the Middle East, and Southeast Asia.[1][2][3][4]

G0092: TA505

TA505 is a cyber criminal group that has been active since at least 2014. TA505 is known for frequently changing malware, driving global trends in criminal malware distribution, and ransomware campaigns involving Clop.[1][2][3][4][5]

G0040: Patchwork

Patchwork is a cyber espionage group that was first observed in December 2015. While the group has not been definitively attributed, circumstantial evidence suggests the group may be a pro-Indian or Indian entity. Patchwork has been seen targeting industries related to diplomatic and government agencies. Much of the code used by this group was copied and pasted from online forums. Patchwork was also seen operating spearphishing campaigns targeting U.S. think tank groups in March and April of 2018.[1] [2][3][4]

C0004: CostaRicto

CostaRicto was a suspected hacker-for-hire cyber espionage campaign that targeted multiple industries worldwide, with a large number being financial institutions. CostaRicto actors targeted organizations in Europe, the Americas, Asia, Australia, and Africa, with a large concentration in South Asia (especially India, Bangladesh, and Singapore), using custom malware, open source tools, and a complex network of proxies and SSH tunnels.[1]

C0014: Operation Wocao

Operation Wocao was a cyber espionage campaign that targeted organizations around the world, including in Brazil, China, France, Germany, Italy, Mexico, Portugal, Spain, the United Kingdom, and the United States. The suspected China-based actors compromised government organizations and managed service providers, as well as aviation, construction, energy, finance, health care, insurance, offshore engineering, software development, and transportation companies.[1]

Security researchers assessed the Operation Wocao actors used similar TTPs and tools as APT20, suggesting a possible overlap. Operation Wocao was named after an observed command line entry by one of the threat actors, possibly out of frustration from losing webshell access.[1]

Relationship explorer

All related ATT&CK context

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release: 19.1
Object version: 1.6
Created: Apr 18, 2018, 17:59 UTC (UTC+00:00)
Modified: Apr 16, 2025, 20:38 UTC (UTC+00:00)
Raw hash: 28eaf6e5a6ba8f95...

Imported snapshots across ATT&CK releases (1)

Release	Bundle imported	Object version	Modified	Status	Raw hash
19.1	May 18, 2026, 07:08 UTC (UTC+00:00)	1.6	Apr 16, 2025, 20:38 UTC (UTC+00:00)	Current bundle	`28eaf6e5a6ba…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
GitHub PowerSploit May 2012

PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.
Open source URL
[2]
PowerShellMagazine PowerSploit July 2014

Graeber, M. (2014, July 8). PowerSploit. Retrieved February 6, 2018.
Open source URL
[3]
PowerSploit Documentation

PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.
Open source URL
[4]
mitre-attack S0194
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use

Analyst context for executives and security teams