{
  "family": "psshell",
  "sample_count": 1,
  "category": "ransomware",
  "description": "<h3>Executive Summary</h3>\nPSShell refers to a category of offensive PowerShell scripts and frameworks (such as Nishang or Empire modules) designed to establish a remote, interactive command shell on a compromised Windows system. While PowerShell is a legitimate administrative tool, \"PSShell\" variants are specifically weaponized to evade detection, bypass execution policies, and provide threat actors with a powerful \"Living off the Land\" (LotL) mechanism for post-exploitation, lateral movement, and data exfiltration.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nPSShell scripts are rarely the initial infection vector. They are typically executed by an initial dropper (like a malicious macro) or deployed by an attacker who has already compromised an endpoint via RDP brute-forcing or vulnerability exploitation.\n\nOnce deployed, PSShell frameworks exhibit advanced offensive capabilities:\n<ul>\n<li><strong>Fileless Execution:</strong> PSShells are often executed entirely in memory using \"Download Cradles\" (e.g., `Invoke-Expression (New-Object Net.WebClient).DownloadString(...)`). This allows the attacker to establish a reverse shell without ever writing a `.ps1` script file to the hard drive, evading many traditional antivirus scanners.</li>\n<li><strong>AMSI Evasion:</strong> Modern PSShell frameworks incorporate code specifically designed to hook and bypass the Windows Anti-Malware Scan Interface (AMSI), preventing Windows Defender from scanning the malicious PowerShell commands as they are executed.</li>\n<li><strong>Post-Exploitation Framework:</strong> Once the shell is established, the attacker has unrestricted command-line access to the system. They can utilize built-in PowerShell cmdlets to dump credentials (e.g., Mimikatz modules), enumerate Active Directory, and pivot to other systems on the network.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe detection of an unauthorized PSShell is a critical incident indicating that an attacker has achieved interactive, command-line control over the endpoint. It signifies a mature compromise where the adversary is actively navigating the network and likely preparing for a larger objective, such as ransomware deployment or data theft.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Behavioral Monitoring (EDR and Script Block Logging):</strong> Detection relies heavily on EDR telemetry and Windows Event Log 4104 (Script Block Logging). Analysts must review these logs to reconstruct the commands executed by the attacker during the PSShell session.</li>\n<li><strong>Immediate Network Isolation:</strong> The endpoint must be isolated instantly to severe the reverse shell connection and halt the attacker's lateral movement.</li>\n<li><strong>Total Re-imaging:</strong> Because the attacker had interactive command-line access, they could have established deep, secondary persistence mechanisms (like WMI event subscriptions or modified registry keys) that are difficult to uncover. A complete bare-metal wipe and re-image is required, alongside a global password reset.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "HackTool.PSShell",
    "Riskware.PowerShell",
    "Trojan.PowerShell.ReverseShell",
    "Nishang"
  ],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Psshell and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Psshell is classified as a Ransomware. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Psshell establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Psshell typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Psshell compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Psshell should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What cryptographic algorithms and file targeting techniques does HackTool.PSShell employ during execution?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "HackTool.PSShell typically leverages hybrid cryptographic architectures combining symmetric stream or block ciphers (such as AES-256 or ChaCha20) for rapid file encryption with asymmetric algorithms (such as RSA-2048 or Curve25519) to securely protect the session keys. It aggressively targets sensitive file extensions including corporate documents, databases, virtual disks, and backups while systematically executing commands to delete Volume Shadow Copies (vssadmin delete shadows /all /quiet) and disable system recovery options."
      }
    },
    {
      "@type": "Question",
      "name": "Are decryptors available for HackTool.PSShell, and what is the recommended recovery procedure?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Decryption availability for HackTool.PSShell depends on whether security researchers or law enforcement (such as the No More Ransom initiative) have recovered the master private keys or discovered flaws in its key generation routines. Victims should never pay the extortion demand, as payment fuels criminal operations without guaranteeing file restoration. The recommended recovery procedure entails isolating infected hosts, conducting forensic disk imaging, identifying the root access vector, and restoring validated systems from immutable offline backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.001",
    "T1059",
    "T1562.001",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "type": "HackTool / Riskware (PowerShell)",
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "mitre_attack_detail": [
    {
      "id": "T1059.001",
      "name": "Command and Scripting Interpreter: PowerShell (Used in infection chain)",
      "tactic": "Execution"
    },
    {
      "id": "T1059",
      "name": "Command and Scripting Interpreter",
      "tactic": "Execution"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols (C2 Communication)",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Immediately isolate affected host(s) from the internal network (disconnect physical Ethernet and disable Wi-Fi/Bluetooth) to prevent Psshell from spreading laterally or encrypting network-attached storage (NAS) and shared SMB volumes.",
    "Preserve volatile system memory (RAM capture) on a representative endpoint before attempting a reboot or power-down, as Psshell symmetric encryption keys or uncompiled payload components may still reside in memory.",
    "Audit process execution logs and terminate active scripting interpreters (e.g. PowerShell, CMD, WScript) or commands executing 'vssadmin.exe delete shadows' or 'wbadmin' used by Psshell to inhibit recovery.",
    "Investigate the initial compromise vector (such as exposed RDP instances, spearphishing attachments, or vulnerable edge gateways) and enforce an immediate credential reset for all compromised Active Directory accounts.",
    "Restore critical assets and databases exclusively from verified, air-gapped, or immutable offline backups once the Psshell binary and related persistence hooks are eradicated."
  ],
  "what_to_avoid": [
    "Do not restart or power cycle infected systems prematurely; doing so destroys volatile RAM encryption keys and may trigger bootloader locking logic embedded in Psshell.",
    "Avoid negotiating or paying the extortion demand without prior forensic evaluation and consultation with incident response specialists, as payment does not guarantee data recovery.",
    "Do not connect clean backup drives or external storage to the affected network until Psshell eradication is completely verified."
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}