T1059.001Execution
PowerShell
Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the Start-Process cmdlet which can be used to run an executable…
CVEs2
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.2
Reports1
Detections
222 Sigma rules tagged T1059.001PowerShellT1059.001222 general rules
- Bad Opsec Powershell Code Artifactscriticaltest
- Greenbug Espionage Group Indicatorscriticaltest
- Rorschach Ransomware Execution Activitycriticaltest
- Silence.EDA Detectioncriticaltest
- Turla Group Commands May 2020criticaltest
- UNC2452 PowerShell Patterncriticaltest
- HackTool - CrackMapExec Execution Patternshighstable
- Potential Emotet Activityhighstable
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to PowerShell
2 CVEs, by priority. Each link shows its badge.- CVE-2018-20753Kaseya VSA Remote Code Execution VulnerabilityKaseya · Virtual System/Server Administrator (VSA)KEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059.001PowerShellAI mapping from the description · primary impact29.6%Top 1.8%79.5priority
- CVE-2022-41082Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft · Exchange ServerKEVRansomwarePublic exploitHigh · 8.0T1078Valid AccountsT1059.001PowerShell+4 moreMITRE CTID mapping of the KEV entry · how it is exploited>99.9%Top 0.02%78.6priority