LiveActive security incident?Get immediate response
MITRE ATT&CK® Tool

S0194: PowerSploit

PowerSploit is an open source, offensive security framework comprised of PowerShell modules and scripts that perform a wide range of tasks related to penetration testing such as code execution, persistence, bypassing anti-virus, recon, and exfiltration. [1] [2] [3]

EnterpriseS0194ToolObject v1.6Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

PowerSploit matters because it packages many post-compromise actions into PowerShell modules on Windows: execution, persistence, antivirus bypass, reconnaissance, credential-oriented activity, collection, and exfiltration-related tasks. For leaders, the decision value is not whether the tool name appears in alerts, but whether the organization can reliably see and investigate suspicious PowerShell-driven behavior across endpoints before it becomes broader credential theft, persistence, or data collection.

Executive priority

Prioritize this as a Windows endpoint visibility and response-readiness issue. ATT&CK links PowerSploit to multiple campaigns and groups, and the tool maps to behaviors that affect incident scope decisions: LSASS memory access, WMI execution, scheduled tasks, registry querying, keylogging, process discovery, account discovery, screen capture, and data collection. Executives should ask whether SOC and IR teams can prove collection of PowerShell, process, credential-access, and persistence telemetry, and whether legitimate administration or red-team use is governed well enough to avoid blind spots.

Technical view

PowerSploit is an open-source PowerShell post-exploitation framework. ATT&CK does not provide a detection section for this object, so validation should be behavior-led using the related techniques: T1059.001 PowerShell, T1047 WMI, T1053.005 Scheduled Task, T1003.001 LSASS Memory, T1012 Query Registry, T1055.001 DLL Injection, T1056.001 Keylogging, T1057 Process Discovery, T1087.001 Local Account, T1113 Screen Capture, T1005 Data from Local System, and T1027.005/T1027.010 obfuscation and tool modification. Detection engineering should avoid depending only on static PowerSploit strings because the framework is open source and the ATT&CK relationships include obfuscation and indicator removal behaviors.

Likely telemetry

  • PowerShell execution records, including script content where available, command lines, module activity, and encoded or obfuscated command indicators
  • Windows process creation and parent-child process relationships involving PowerShell, WMI, scheduled task utilities, and administrative shells
  • WMI activity and remote/local command execution evidence
  • Scheduled task creation, modification, and execution events
  • Windows Registry query activity relevant to discovery

Detection direction

  • Build coverage around behaviors mapped to the related ATT&CK techniques rather than only the PowerSploit name or repository-derived signatures.
  • Tune for suspicious PowerShell patterns: unusual parents, encoded or obfuscated commands, script execution from user-writable paths, and PowerShell followed by discovery, credential access, persistence, or collection activity.
  • Correlate PowerShell with WMI execution, scheduled task creation, registry queries, process/account discovery, LSASS access, screen capture, and local data collection to improve fidelity.
  • Account for legitimate security testing and administrative PowerShell use; require change records or test windows so approved PowerSploit-like activity does not normalize real intrusions.
  • Review blind spots caused by missing script block visibility, disabled command-line logging, endpoint-only detections without central retention, and detections that rely on static indicators despite ATT&CK-linked obfuscation and indicator-removal techniques.

Mitigation priorities

  • Establish governance for authorized PowerShell and penetration-testing frameworks, including approval, logging requirements, and post-test cleanup evidence.
  • Harden PowerShell execution where operationally feasible and ensure administrative use is auditable on Windows endpoints.
  • Prioritize endpoint controls and monitoring for credential-access behaviors, especially LSASS memory access, because related techniques can materially affect lateral movement and incident scope.
  • Monitor and restrict persistence mechanisms such as scheduled tasks where business use does not justify broad creation rights.
  • Ensure SOC and IR playbooks cover PowerShell-led investigations, including triage of WMI, scheduled tasks, registry discovery, process/account discovery, collection, and screen capture evidence.
Additional notes and limits

ATT&CK identifies PowerSploit as an open-source offensive security framework made of PowerShell modules and scripts. Relationship context shows use by campaigns and groups including CostaRicto, Operation Wocao, Patchwork, menuPass, FIN7, APT33, Leviathan, MuddyWater, TA505, APT41, and Earth Lusca, and maps the tool to multiple execution, persistence, discovery, credential access, collection, privilege escalation, and stealth techniques. This supports a behavior-focused defensive take, not an attribution conclusion.

The official ATT&CK object provides no dedicated detection guidance and no tactics directly on the tool object. Local conclusions require environment-specific telemetry, authorized-use records, endpoint logging configuration, and IR evidence. The presence of PowerShell activity alone is not sufficient to identify PowerSploit or malicious use.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

PowerSploit

PowerSploit is an open source, offensive security framework comprised of PowerShell modules and scripts that perform a wide range of tasks related to penetration testing such as code execution, persistence, bypassing anti-virus, recon, and exfiltration. [1] [2] [3]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

28 rows
DomainIDNameRelationship / procedure
EnterpriseT1574.007Path Interception by PATH Environment VariableSub-technique

PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit path interception opportunities in the PATH environment variable.[1][3]

EnterpriseT1056.001KeyloggingSub-technique

PowerSploit's Get-Keystrokes Exfiltration module can log keystrokes.[1][3]

EnterpriseT1620Reflective Code Loading

PowerSploit reflectively loads a Windows PE file into a process.[1][3]

EnterpriseT1552.002Credentials in RegistrySub-technique

PowerSploit has several modules that search the Windows Registry for stored credentials: Get-UnattendedInstallFile, Get-Webconfig, Get-ApplicationHost, Get-SiteListPassword, Get-CachedGPPPassword, and Get-RegistryAutoLogon.[6]

EnterpriseT1027.005Indicator Removal from ToolsSub-technique

PowerSploit's Find-AVSignature AntivirusBypass module can be used to locate single byte anti-virus signatures.[1][3]

EnterpriseT1123Audio Capture

PowerSploit's Get-MicrophoneAudio Exfiltration module can record system microphone audio.[1][3]

EnterpriseT1047Windows Management Instrumentation

PowerSploit's Invoke-WmiCommand CodeExecution module uses WMI to execute and retrieve the output from a PowerShell payload.[1][3]

EnterpriseT1574.009Path Interception by Unquoted PathSub-technique

PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit unquoted path vulnerabilities.[1][3]

EnterpriseT1012Query Registry

PowerSploit contains a collection of Privesc-PowerUp modules that can query Registry keys for potential opportunities.[1][3]

EnterpriseT1005Data from Local System

PowerSploit contains a collection of Exfiltration modules that can access data from local files, volumes, and processes.[1][3]

EnterpriseT1552.006Group Policy PreferencesSub-technique

PowerSploit contains a collection of Exfiltration modules that can harvest credentials from Group Policy Preferences.[1][3]

EnterpriseT1055.001Dynamic-link Library InjectionSub-technique

PowerSploit contains a collection of CodeExecution modules that inject code (DLL, shellcode) into a process.[1][3]

EnterpriseT1027.010Command ObfuscationSub-technique

PowerSploit contains a collection of ScriptModification modules that compress and encode scripts and payloads.[1][3]

EnterpriseT1134Access Token Manipulation

PowerSploit's Invoke-TokenManipulation Exfiltration module can be used to manipulate tokens.[1][3]

EnterpriseT1543.003Windows ServiceSub-technique

PowerSploit contains a collection of Privesc-PowerUp modules that can discover and replace/modify service binaries, paths, and configs.[1][3]

EnterpriseT1113Screen Capture

PowerSploit's Get-TimedScreenshot Exfiltration module can take screenshots at regular intervals.[1][3]

EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

PowerSploit's New-UserPersistenceOption Persistence argument can be used to establish via the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key.[1][3]

EnterpriseT1053.005Scheduled TaskSub-technique

PowerSploit's New-UserPersistenceOption Persistence argument can be used to establish via a Scheduled Task/Job.[1][3]

EnterpriseT1574.001DLLSub-technique

PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit DLL hijacking opportunities in services and processes.[1][3]

EnterpriseT1574.008Path Interception by Search Order HijackingSub-technique

PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit search order hijacking vulnerabilities.[1][3]

EnterpriseT1558.003KerberoastingSub-technique

PowerSploit's Invoke-Kerberoast module can request service tickets and return crackable ticket hashes.[15][16]

EnterpriseT1087.001Local AccountSub-technique

PowerSploit's Get-ProcessTokenGroup Privesc-PowerUp module can enumerate all SIDs associated with its current token.[1][3]

EnterpriseT1547.005Security Support ProviderSub-technique

PowerSploit's Install-SSP Persistence module can be used to establish by installing a SSP DLL.[1][3]

EnterpriseT1057Process Discovery

PowerSploit's Get-ProcessTokenPrivilege Privesc-PowerUp module can enumerate privileges for a given process.[1][3]

EnterpriseT1555.004Windows Credential ManagerSub-technique

PowerSploit contains a collection of Exfiltration modules that can harvest credentials from Windows vault credential objects.[1][3]

EnterpriseT1059.001PowerShellSub-technique

PowerSploit modules are written in and executed via PowerShell.[1][3]

EnterpriseT1482Domain Trust Discovery

PowerSploit has modules such as Get-NetDomainTrust and Get-NetForestTrust to enumerate domain and forest trusts.[1][3]

EnterpriseT1003.001LSASS MemorySub-technique

PowerSploit contains a collection of Exfiltration modules that can harvest credentials using Mimikatz.[1][3]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0064: APT33

APT33 is a suspected Iranian threat group that has carried out operations since at least 2013. The group has targeted organizations across multiple industries in the United States, Saudi Arabia, and South Korea, with a particular interest in the aviation and energy sectors.[1][2]

GroupEnterprise

G1006: Earth Lusca

Earth Lusca is a suspected China-based cyber espionage group that has been active since at least April 2019. Earth Lusca has targeted organizations in Australia, China, Hong Kong, Mongolia, Nepal, the Philippines, Taiwan, Thailand, Vietnam, the United Arab Emirates, Nigeria, Germany, France, and the United States. Targets included government institutions, news media outlets, gambling companies, educational institutions, COVID-19 research organizations, telecommunications companies, religious movements banned in China, and cryptocurrency trading platforms; security researchers assess some Earth Lusca operations may be financially motivated.[1]

Earth Lusca has used malware commonly used by other Chinese threat groups, including APT41 and the Winnti Group cluster, however security researchers assess Earth Lusca's techniques and infrastructure are separate.[1]

GroupEnterprise

G0096: APT41

APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, APT41 has been observed targeting various industries, including but not limited to healthcare, telecom, technology, finance, education, retail and video game industries in 14 countries.[1] Notable behaviors include using a wide range of malware and tools to complete mission objectives. APT41 overlaps at least partially with public reporting on groups including BARIUM and Winnti Group.[2][3]

GroupEnterprise

G0069: MuddyWater

MuddyWater is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS).[1] Since at least 2017, MuddyWater has targeted a range of government and private organizations across sectors, including telecommunications, local government, finance, defense, and oil and natural gas organizations, in the Middle East (specifically the UAE and Saudi Arabia), Asia, Africa, Europe, and North America. MuddyWater has reused domains dating back to October 2025, and has a preference for NameCheap and Hosterdaddy Private Limited (AS136557). In late 2025 and early 2026, MuddyWater used commercial satellite internet (i.e., Starlink) for command and control (C2) communication. [2][3][4][5][6][7][8][9][10][11][12][13]

GroupEnterprise

G0046: FIN7

FIN7 is a financially-motivated threat group that has been active since 2013. FIN7 has targeted the retail, restaurant, hospitality, software, consulting, financial services, medical equipment, cloud services, media, food and beverage, transportation, pharmaceutical, and utilities industries in the United States. A portion of FIN7 was operated out of a front company called Combi Security and often used point-of-sale malware for targeting efforts. Since 2020, FIN7 shifted operations to big game hunting (BGH), including use of REvil ransomware and their own Ransomware-as-a-Service (RaaS), Darkside. FIN7 may be linked to the Carbanak Group, but multiple threat groups have been observed using Carbanak, leading these groups to be tracked separately.[1][2][3][4][5][6][7]

GroupEnterprise

G0045: menuPass

menuPass is a threat group that has been active since at least 2006. Individual members of menuPass are known to have acted in association with the Chinese Ministry of State Security's (MSS) Tianjin State Security Bureau and worked for the Huaying Haitai Science and Technology Development Company.[1][2]

menuPass has targeted healthcare, defense, aerospace, finance, maritime, biotechnology, energy, and government sectors globally, with an emphasis on Japanese organizations. In 2016 and 2017, the group is known to have targeted managed IT service providers (MSPs), manufacturing and mining companies, and a university.[3][4][5][6][7][1][2]

GroupEnterprise

G0065: Leviathan

Leviathan is a Chinese state-sponsored cyber espionage group that has been attributed to the Ministry of State Security's (MSS) Hainan State Security Department and an affiliated front company.[1] Active since at least 2009, Leviathan has targeted the following sectors: academia, aerospace/aviation, biomedical, defense industrial base, government, healthcare, manufacturing, maritime, and transportation across the US, Canada, Australia, Europe, the Middle East, and Southeast Asia.[1][2][3][4]

GroupEnterprise

G0092: TA505

TA505 is a cyber criminal group that has been active since at least 2014. TA505 is known for frequently changing malware, driving global trends in criminal malware distribution, and ransomware campaigns involving Clop.[1][2][3][4][5]

GroupEnterprise

G0040: Patchwork

Patchwork is a cyber espionage group that was first observed in December 2015. While the group has not been definitively attributed, circumstantial evidence suggests the group may be a pro-Indian or Indian entity. Patchwork has been seen targeting industries related to diplomatic and government agencies. Much of the code used by this group was copied and pasted from online forums. Patchwork was also seen operating spearphishing campaigns targeting U.S. think tank groups in March and April of 2018.[1] [2][3][4]

CampaignEnterprise

C0004: CostaRicto

CostaRicto was a suspected hacker-for-hire cyber espionage campaign that targeted multiple industries worldwide, with a large number being financial institutions. CostaRicto actors targeted organizations in Europe, the Americas, Asia, Australia, and Africa, with a large concentration in South Asia (especially India, Bangladesh, and Singapore), using custom malware, open source tools, and a complex network of proxies and SSH tunnels.[1]

CampaignEnterprise

C0014: Operation Wocao

Operation Wocao was a cyber espionage campaign that targeted organizations around the world, including in Brazil, China, France, Germany, Italy, Mexico, Portugal, Spain, the United Kingdom, and the United States. The suspected China-based actors compromised government organizations and managed service providers, as well as aviation, construction, energy, finance, health care, insurance, offshore engineering, software development, and transportation companies.[1]

Security researchers assessed the Operation Wocao actors used similar TTPs and tools as APT20, suggesting a possible overlap. Operation Wocao was named after an observed command line entry by one of the threat actors, possibly out of frustration from losing webshell access.[1]

Relationship explorer

All related ATT&CK context

uses · CampaignC0004: CostaRictoEnterpriseuses · TechniqueT1574.007: Path Interception by PATH Environment VariableEnterpriseuses · GroupG0064: APT33Enterpriseuses · TechniqueT1056.001: KeyloggingEnterpriseuses · TechniqueT1620: Reflective Code LoadingEnterpriseuses · TechniqueT1552.002: Credentials in RegistryEnterpriseuses · TechniqueT1027.005: Indicator Removal from ToolsEnterpriseuses · TechniqueT1123: Audio CaptureEnterpriseuses · TechniqueT1047: Windows Management InstrumentationEnterpriseuses · TechniqueT1574.009: Path Interception by Unquoted PathEnterpriseuses · TechniqueT1012: Query RegistryEnterpriseuses · TechniqueT1005: Data from Local SystemEnterpriseuses · TechniqueT1552.006: Group Policy PreferencesEnterpriseuses · GroupG1006: Earth LuscaEnterpriseuses · GroupG0096: APT41Enterpriseuses · TechniqueT1055.001: Dynamic-link Library InjectionEnterpriseuses · TechniqueT1027.010: Command ObfuscationEnterpriseuses · TechniqueT1134: Access Token ManipulationEnterpriseuses · GroupG0069: MuddyWaterEnterpriseuses · CampaignC0014: Operation WocaoEnterpriseuses · TechniqueT1543.003: Windows ServiceEnterpriseuses · GroupG0046: FIN7Enterpriseuses · TechniqueT1113: Screen CaptureEnterpriseuses · TechniqueT1547.001: Registry Run Keys / Startup FolderEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.6
Created
Modified
Raw hash
28eaf6e5a6ba8f95...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.6Current bundle28eaf6e5a6ba…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    GitHub PowerSploit May 2012

    PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.

    Open source URL
  2. [2]
    PowerShellMagazine PowerSploit July 2014

    Graeber, M. (2014, July 8). PowerSploit. Retrieved February 6, 2018.

  3. [3]
    PowerSploit Documentation

    PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

  4. [4]
    BlackBerry CostaRicto November 2020

    The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.

    Open source URL
  5. [5]
    FireEye APT33 Guardrail

    Ackerman, G., et al. (2018, December 21). OVERRULED: Containing a Potentially Destructive Adversary. Retrieved January 17, 2019.

    Open source URL
  6. [6]
    Pentestlab Stored Credentials

    netbiosX. (2017, April 19). Stored Credentials. Retrieved April 6, 2018.

    Open source URL
  7. [7]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  8. [8]
    FireEye APT41 Aug 2019

    Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.

    Open source URL
  9. [9]
    TrendMicro POWERSTATS V3 June 2019

    Lunghi, D. and Horejsi, J.. (2019, June 10). MuddyWater Resurfaces, Uses Multi-Stage Backdoor POWERSTATS V3 and New Post-Exploitation Tools. Retrieved May 14, 2020.

    Open source URL
  10. [10]
    FoxIT Wocao December 2019

    Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020.

    Open source URL
  11. [11]
    CrowdStrike Carbon Spider August 2021

    Loui, E. and Reynolds, J. (2021, August 30). CARBON SPIDER Embraces Big Game Hunting, Part 1. Retrieved September 20, 2021.

    Open source URL
  12. [12]
    Mandiant FIN7 Apr 2022

    Abdo, B., et al. (2022, April 4). FIN7 Power Hour: Adversary Archaeology and the Evolution of FIN7. Retrieved April 5, 2022.

    Open source URL
  13. [13]
    PWC Cloud Hopper Technical Annex April 2017

    PwC and BAE Systems. (2017, April). Operation Cloud Hopper: Technical Annex. Retrieved April 13, 2017.

    Open source URL
  14. [14]
    CISA AA21-200A APT40 July 2021

    CISA. (2021, July 19). (AA21-200A) Joint Cybersecurity Advisory – Tactics, Techniques, and Procedures of Indicted APT40 Actors Associated with China’s MSS Hainan State Security Department. Retrieved August 12, 2021.

    Open source URL
  15. [15]
    PowerSploit Invoke Kerberoast

    Schroeder, W. & Hart M. (2016, October 31). Invoke-Kerberoast. Retrieved March 23, 2018.

    Open source URL
  16. [16]
    Harmj0y Kerberoast Nov 2016

    Schroeder, W. (2016, November 1). Kerberoasting Without Mimikatz. Retrieved September 23, 2024.

    Open source URL
  17. [17]
    NCC Group TA505

    Terefos, A. (2020, November 18). TA505: A Brief History of Their Time. Retrieved July 14, 2022.

    Open source URL
  18. [18]
    Cymmetria Patchwork

    Cymmetria. (2016). Unveiling Patchwork - The Copy-Paste APT. Retrieved November 17, 2024.

    Open source URL
  19. [19]
    GitHub PowerSploit May 2012

    PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.

    Open source URL
  20. [20]
    GitHub PowerSploit May 2012

    PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.

    Open source URL
  21. [21]
    PowerShellMagazine PowerSploit July 2014

    Graeber, M. (2014, July 8). PowerSploit. Retrieved February 6, 2018.

  22. [22]
    PowerShellMagazine PowerSploit July 2014

    Graeber, M. (2014, July 8). PowerSploit. Retrieved February 6, 2018.

  23. [23]
    PowerSploit Documentation

    PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

  24. [24]
    PowerSploit Documentation

    PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

  25. [25]
    mitre-attackS0194
    Open source URL
  26. [26]
    mitre-attackS0194
    Open source URL
  27. [27]
    mitre-attackS0194
    Open source URL
  28. [28]
    BlackBerry CostaRicto November 2020

    The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.

    Open source URL
  29. [29]
    GitHub PowerSploit May 2012

    PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.

    Open source URL
  30. [30]
    GitHub PowerSploit May 2012

    PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.

    Open source URL
  31. [31]
    PowerSploit Documentation

    PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

  32. [32]
    PowerSploit Documentation

    PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

  33. [33]
    FireEye APT33 Guardrail

    Ackerman, G., et al. (2018, December 21). OVERRULED: Containing a Potentially Destructive Adversary. Retrieved January 17, 2019.

    Open source URL
  34. [34]
    GitHub PowerSploit May 2012

    PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.

    Open source URL
  35. [35]
    GitHub PowerSploit May 2012

    PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.

    Open source URL
  36. [36]
    PowerSploit Documentation

    PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

  37. [37]
    PowerSploit Documentation

    PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

  38. [38]
    GitHub PowerSploit May 2012

    PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.

    Open source URL
  39. [39]
    GitHub PowerSploit May 2012

    PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.

    Open source URL
  40. [40]
    PowerSploit Documentation

    PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

  41. [41]
    PowerSploit Documentation

    PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

  42. [42]
    Pentestlab Stored Credentials

    netbiosX. (2017, April 19). Stored Credentials. Retrieved April 6, 2018.

    Open source URL
  43. [43]
    GitHub PowerSploit May 2012

    PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.

    Open source URL
  44. [44]
    GitHub PowerSploit May 2012

    PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.

    Open source URL
  45. [45]
    PowerSploit Documentation

    PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

  46. [46]
    PowerSploit Documentation

    PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

  47. [47]
    GitHub PowerSploit May 2012

    PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.

    Open source URL
  48. [48]
    GitHub PowerSploit May 2012

    PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.

    Open source URL
  49. [49]
    PowerSploit Documentation

    PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

  50. [50]
    PowerSploit Documentation

    PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

  51. [51]
    GitHub PowerSploit May 2012

    PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.

    Open source URL
  52. [52]
    GitHub PowerSploit May 2012

    PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.

    Open source URL
  53. [53]
    PowerSploit Documentation

    PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

  54. [54]
    PowerSploit Documentation

    PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

  55. [55]
    GitHub PowerSploit May 2012

    PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.

    Open source URL
  56. [56]
    GitHub PowerSploit May 2012

    PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.

    Open source URL
  57. [57]
    PowerSploit Documentation

    PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

  58. [58]
    PowerSploit Documentation

    PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

  59. [59]
    GitHub PowerSploit May 2012

    PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.

    Open source URL
  60. [60]
    GitHub PowerSploit May 2012

    PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.

    Open source URL
  61. [61]
    PowerSploit Documentation

    PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

  62. [62]
    PowerSploit Documentation

    PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

  63. [63]
    GitHub PowerSploit May 2012

    PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.

    Open source URL
  64. [64]
    GitHub PowerSploit May 2012

    PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.

    Open source URL
  65. [65]
    PowerSploit Documentation

    PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

  66. [66]
    PowerSploit Documentation

    PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

  67. [67]
    GitHub PowerSploit May 2012

    PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.

    Open source URL
  68. [68]
    GitHub PowerSploit May 2012

    PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.

    Open source URL
  69. [69]
    PowerSploit Documentation

    PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

  70. [70]
    PowerSploit Documentation

    PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

  71. [71]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  72. [72]
    FireEye APT41 Aug 2019

    Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.

    Open source URL
  73. [73]
    GitHub PowerSploit May 2012

    PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.

    Open source URL
  74. [74]
    GitHub PowerSploit May 2012

    PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.

    Open source URL
  75. [75]
    PowerSploit Documentation

    PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

  76. [76]
    PowerSploit Documentation

    PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

  77. [77]
    GitHub PowerSploit May 2012

    PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.

    Open source URL
  78. [78]
    GitHub PowerSploit May 2012

    PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.

    Open source URL
  79. [79]
    PowerSploit Documentation

    PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

  80. [80]
    PowerSploit Documentation

    PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

  81. [81]
    GitHub PowerSploit May 2012

    PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.

    Open source URL
  82. [82]
    GitHub PowerSploit May 2012

    PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.

    Open source URL
  83. [83]
    PowerSploit Documentation

    PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

  84. [84]
    PowerSploit Documentation

    PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

  85. [85]
    TrendMicro POWERSTATS V3 June 2019

    Lunghi, D. and Horejsi, J.. (2019, June 10). MuddyWater Resurfaces, Uses Multi-Stage Backdoor POWERSTATS V3 and New Post-Exploitation Tools. Retrieved May 14, 2020.

    Open source URL
  86. [86]
    FoxIT Wocao December 2019

    Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020.

    Open source URL
  87. [87]
    GitHub PowerSploit May 2012

    PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.

    Open source URL
  88. [88]
    GitHub PowerSploit May 2012

    PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.

    Open source URL
  89. [89]
    PowerSploit Documentation

    PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

  90. [90]
    PowerSploit Documentation

    PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

  91. [91]
    CrowdStrike Carbon Spider August 2021

    Loui, E. and Reynolds, J. (2021, August 30). CARBON SPIDER Embraces Big Game Hunting, Part 1. Retrieved September 20, 2021.

    Open source URL
  92. [92]
    Mandiant FIN7 Apr 2022

    Abdo, B., et al. (2022, April 4). FIN7 Power Hour: Adversary Archaeology and the Evolution of FIN7. Retrieved April 5, 2022.

    Open source URL
  93. [93]
    GitHub PowerSploit May 2012

    PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.

    Open source URL
  94. [94]
    GitHub PowerSploit May 2012

    PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.

    Open source URL
  95. [95]
    PowerSploit Documentation

    PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

  96. [96]
    PowerSploit Documentation

    PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

  97. [97]
    GitHub PowerSploit May 2012

    PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.

    Open source URL
  98. [98]
    GitHub PowerSploit May 2012

    PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.

    Open source URL
  99. [99]
    PowerSploit Documentation

    PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

  100. [100]
    PowerSploit Documentation

    PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

  101. [101]
    PWC Cloud Hopper Technical Annex April 2017

    PwC and BAE Systems. (2017, April). Operation Cloud Hopper: Technical Annex. Retrieved April 13, 2017.

    Open source URL
  102. [102]
    GitHub PowerSploit May 2012

    PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.

    Open source URL
  103. [103]
    GitHub PowerSploit May 2012

    PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.

    Open source URL
  104. [104]
    PowerSploit Documentation

    PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

  105. [105]
    PowerSploit Documentation

    PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

  106. [106]
    CISA AA21-200A APT40 July 2021

    CISA. (2021, July 19). (AA21-200A) Joint Cybersecurity Advisory – Tactics, Techniques, and Procedures of Indicted APT40 Actors Associated with China’s MSS Hainan State Security Department. Retrieved August 12, 2021.

    Open source URL
  107. [107]
    GitHub PowerSploit May 2012

    PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.

    Open source URL
  108. [108]
    GitHub PowerSploit May 2012

    PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.

    Open source URL
  109. [109]
    PowerSploit Documentation

    PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

  110. [110]
    PowerSploit Documentation

    PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

  111. [111]
    GitHub PowerSploit May 2012

    PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.

    Open source URL
  112. [112]
    GitHub PowerSploit May 2012

    PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.

    Open source URL
  113. [113]
    PowerSploit Documentation

    PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

  114. [114]
    PowerSploit Documentation

    PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

  115. [115]
    Harmj0y Kerberoast Nov 2016

    Schroeder, W. (2016, November 1). Kerberoasting Without Mimikatz. Retrieved September 23, 2024.

    Open source URL
  116. [116]
    PowerSploit Invoke Kerberoast

    Schroeder, W. & Hart M. (2016, October 31). Invoke-Kerberoast. Retrieved March 23, 2018.

    Open source URL
  117. [117]
    GitHub PowerSploit May 2012

    PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.

    Open source URL
  118. [118]
    GitHub PowerSploit May 2012

    PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.

    Open source URL
  119. [119]
    PowerSploit Documentation

    PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

  120. [120]
    PowerSploit Documentation

    PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

  121. [121]
    GitHub PowerSploit May 2012

    PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.

    Open source URL
  122. [122]
    GitHub PowerSploit May 2012

    PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.

    Open source URL
  123. [123]
    PowerSploit Documentation

    PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

  124. [124]
    PowerSploit Documentation

    PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

  125. [125]
    GitHub PowerSploit May 2012

    PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.

    Open source URL
  126. [126]
    GitHub PowerSploit May 2012

    PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.

    Open source URL
  127. [127]
    PowerSploit Documentation

    PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

  128. [128]
    PowerSploit Documentation

    PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

  129. [129]
    GitHub PowerSploit May 2012

    PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.

    Open source URL
  130. [130]
    GitHub PowerSploit May 2012

    PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.

    Open source URL
  131. [131]
    PowerSploit Documentation

    PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

  132. [132]
    PowerSploit Documentation

    PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

  133. [133]
    GitHub PowerSploit May 2012

    PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.

    Open source URL
  134. [134]
    PowerSploit Documentation

    PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

  135. [135]
    GitHub PowerSploit May 2012

    PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.

    Open source URL
  136. [136]
    PowerSploit Documentation

    PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

  137. [137]
    GitHub PowerSploit May 2012

    PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.

    Open source URL
  138. [138]
    PowerSploit Documentation

    PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use