T1059.001: Command and Scripting Interpreter: PowerShell (Used in infection chain)
Operational Executive Summary
T1059.001 (Command and Scripting Interpreter: PowerShell (Used in infection chain)) is classified under the Execution tactic within the MITRE ATT&CK framework. Techniques that result in adversary-controlled code running on a local or remote target system, including command-line interpreters, PowerShell payloads, and native binary proxy execution. In telemetry gathered across enterprise endpoints and the EMBER 2018 benchmark, this technique was weaponized across 46 distinct malware families, totaling over 5,102 validated samples.
Technical Anatomy & Adversary Tradecraft
Adversaries leverage Command and Scripting Interpreter: PowerShell (Used in infection chain) to accomplish operational objectives while minimizing anomalous forensic footprints. When executing Command and Scripting Interpreter: PowerShell (Used in infection chain), malicious binaries commonly interact directly with low-level Windows APIs, kernel mode drivers, or native scripting interfaces to bypass traditional file-integrity monitors and static antivirus signatures.
In modern multi-stage campaigns, T1059.001 is frequently observed functioning as an intermediate bridge: initial access payloads (such as spearphishing loaders or exploit macros) execute Command and Scripting Interpreter: PowerShell (Used in infection chain) to establish in-memory execution or persistence before staging secondary ransomware or data-exfiltration implants.
Authoritative MITRE ATT&CK Reference: View official technique documentation, sub-techniques, and adversary groups at
https://attack.mitre.org/techniques/T1059/001/.
Detection Engineering & Threat Hunting
Detecting Command and Scripting Interpreter: PowerShell (Used in infection chain) requires telemetry correlation across endpoint detection and response (EDR) agents, Sysmon event streams, and security information event management (SIEM) pipelines:
- Process Creation & Lineage: Monitor parent-child process anomalies where unexpected parent binaries (e.g., Office executables, web browsers, or script hosts) spawn command shells or native Windows utilities.
- API Hooking & Behavioral Telemetry: EDR platforms should flag rapid calls to memory allocation, process injection, or registry manipulation APIs originating from unbacked executable memory regions.
- Network Anomaly Correlation: Cross-reference endpoint execution timestamps with external network socket establishment to identify anomalous beaconing or covert data staging.
SOC Containment & Hardening Guidance
To mitigate risks associated with T1059.001 (Command and Scripting Interpreter: PowerShell (Used in infection chain)) across production infrastructure, security teams should implement the following defensive controls:
- Attack Surface Reduction (ASR): Enforce strict application control policies (WDAC or AppLocker) to restrict execution to signed and verified corporate binaries.
- Least Privilege & Credential Hygiene: Restrict local administrative privileges to prevent adversaries from tampering with defensive agents or escalating privileges.
- Network Microsegmentation: Restrict lateral communication across endpoint VLANs to prevent wormable payloads from utilizing Command and Scripting Interpreter: PowerShell (Used in infection chain) across adjacent network segments.
Cataloged Malware Families Utilizing T1059.001 (46 Families)
The following malware families in the SystemHelpDesk catalog have been verified utilizing T1059.001 (Command and Scripting Interpreter: PowerShell (Used in infection chain)):
46 families
| Family | Category | Sample Count | Technical Summary |
|---|---|---|---|
| kovter | Trojan | 2,414 | Kovter is an extraordinarily evasive, polymorphic malware strain first detected in 2013. Initially engineered as a screen-locking police-impersonation ransomwar... |
| unruy | Click Fraud | 1,267 | Unruy (identified across threat telemetry as Trojan:Win32/Unruy, Trojan-Clicker.Win32.Unruy, and Adware:Win32/Unruy) is an evasive background click-fraud trojan... |
| occamy | Trojan | 589 | Trojan:Win32/Occamy.C (widely cataloged across Microsoft Defender and endpoint telemetry as Trojan:Win32/Occamy or Win32/Occamy) is a high-severity, multi-stage... |
| coins | Cryptominer | 359 | There is no single, specific malware family universally referred to as "coins." Instead, the term is frequently used by security vendors as a descriptor for ent... |
| barys | Infostealer | 200 | Barys (cataloged in threat telemetry under signatures including Trojan:Win32/Barys, Trojan:PowerShell/Barys, and HEUR:Trojan-Spy.MSIL.Stealer) is a modular Wind... |
| stantinko | Botnet | 168 | Stantinko (tracked across threat intelligence feeds as Trojan:Win32/Stantinko, Win32/CoinMiner.Stantinko, and Trojan.Win32.Stantinko) is a massive, highly resil... |
| scriptkd | Ransomware | 15 | Scriptkd (classified as Ransom:Win32/Scriptkd and Trojan-Ransom.Win32.Scriptkd) is a script-based and multi-stage crypto-ransomware family combining Windows Scr... |
| gorgon | Apt | 13 | Gorgon (tracked in threat intelligence as The Gorgon Group, Backdoor:Win32/Gorgon, and Trojan:Win32/Gorgon) is a cyber espionage and targeted crimeware toolset ... |
| retefe | Trojan | 13 | Retefe (historically documented as Trojan:Win32/Retefe and Trojan-Banker.Win32.Retefe) is a sophisticated banking trojan that actively targeted banking institut... |
| casbaneiro | Trojan | 10 | Casbaneiro (classified in antivirus detection telemetry under designations including Trojan:Win32/Casbaneiro, Trojan.Win32.Casbaneiro, and Win32/Casbaneiro) is ... |
| amavaldo | Trojan | 5 | Amavaldo (classified in antivirus detection telemetry under designations including Trojan:Win32/Amavaldo, Trojan.Win32.Amavaldo, and Win32/Amavaldo) is a multi-... |
| sofacy | Trojan | 5 | Trojan:Win32/Sofacy (often synonymous with **X-Agent**, **Sednit**, or **APT28 / Fancy Bear**) represents an extremely sophisticated suite of espionage malware ... |
| dumpy | Trojan | 4 | Trojan:Win32/Dumpy is a highly specialized malware variant designed specifically for **Credential Dumping**. Unlike a general-purpose backdoor, Dumpy has one pr... |
| pshell | Ransomware | 3 | Trojan:PowerShell/Pshell is not a specific malware family, but a highly critical **Generic Heuristic Detection** focused entirely on the malicious abuse of the ... |
| behav | Ransomware | 2 | Behav (classified in antivirus detection telemetry under designations including Ransom:Win32/Behav, Ransom.Win32.Behav, and Win32/Behav) is a crypto-ransomware ... |
| chromepass | Advanced Threat | 2 | HackTool:Win32/Chromepass is a highly specific utility categorized as a Credential Dumper. While it can technically be used legitimately to recover forgotten pa... |
| clearlog | Advanced Threat | 2 | HackTool:Win32/Clearlog is a critical **Heuristic Detection** specifically designed to flag executables, scripts, or command-line activity attempting to wipe th... |
| cryptoload | Ransomware | 2 | TrojanDownloader:Win32/Cryptoload is a specialized, highly obfuscated trojan component whose sole purpose is to establish initial access, bypass endpoint securi... |
| macrodrop | Ransomware | 2 | TrojanDownloader:O97M/Macrodrop is a highly prevalent category of malware that utilizes weaponized Microsoft Office macros (VBA code) to establish an initial fo... |
| alyak | Trojan | 1 | Alyak (classified in antivirus detection telemetry under designations including Trojan:Win32/Alyak, Trojan.Win32.Alyak, and Win32/Alyak) is a multi-stage trojan... |
| buhtrap | Ransomware | 1 | Buhtrap (classified in antivirus detection telemetry under designations including Ransom:Win32/Buhtrap, Ransom.Win32.Buhtrap, and Win32/Buhtrap) is a crypto-ran... |
| cardtool | Trojan | 1 | Cardtool (classified in antivirus detection telemetry under designations including Trojan:Win32/Cardtool, Trojan.Win32.Cardtool, and Win32/Cardtool) is a multi-... |
| clipspy | Advanced Threat | 1 | <h3>Executive Summary</h3> ClipSpy is a utility designed to monitor, inspect, and log the contents of the Windows system clipboard. While it can be utilized leg... |
| eicardemo | Advanced Threat | 1 | <h3>Executive Summary</h3> EICAR Demo (or the EICAR Standard Anti-Virus Test File) is **NOT MALWARE**. It is a safe, standardized, and internationally recognize... |
| familykeylogger | Advanced Threat | 1 | <h3>Executive Summary</h3> FamilyKeylogger is a commercial surveillance application, often marketed to parents for monitoring children, but widely classified by... |
| gemius | Advanced Threat | 1 | <h3>Executive Summary</h3> Gemius is a prominent web analytics and audience measurement technology. While technically a legitimate commercial service used by we... |
| hidcon | Ransomware | 1 | HackTool:Win32/Hidcon (Hidden Console) designates utilities designed specifically to execute command-line tools, batch files, or scripts silently, without displ... |
| molebox | Advanced Threat | 1 | <h3>Executive Summary</h3> Molebox is a dual-use technology. Originally developed as a legitimate commercial software virtualization and packing utility (design... |
| oceanlotus | Backdoor | 1 | <h3>Executive Summary</h3> OceanLotus (also widely known as APT32 or Canvas Assassin) is a highly sophisticated Advanced Persistent Threat (APT) group believed ... |
| powerspritz | Ransomware | 1 | <h3>Executive Summary</h3> PowerSpritz is a sophisticated, fileless malware framework that heavily leverages Microsoft PowerShell to compromise Windows environm... |
| powerun | Ransomware | 1 | <h3>Executive Summary</h3> Powerun (often detected as HackTool.Powerun, Riskware.PowerShell, or Trojan.Powerun) is not a standalone malware family, but rather a... |
| powstage | Ransomware | 1 | <h3>Executive Summary</h3> PowStage (or PowerShell Stager) refers to a class of fileless malware components used extensively in modern, "Living off the Land" (L... |
| proxygate | Advanced Threat | 1 | <h3>Executive Summary</h3> ProxyGate is an application typically classified as Riskware or a Potentially Unwanted Program (PUP) by enterprise security environme... |
| psshell | Ransomware | 1 | <h3>Executive Summary</h3> PSShell refers to a category of offensive PowerShell scripts and frameworks (such as Nishang or Empire modules) designed to establish... |
| pswdump | Advanced Threat | 1 | <h3>Executive Summary</h3> PSWDump is a malicious HackTool and credential dumper specifically designed to extract Windows NT LAN Manager (NTLM) password hashes ... |
| qqfarmassist | Advanced Threat | 1 | <h3>Executive Summary</h3> QQFarmAssist is classified as a Potentially Unwanted Program (PUP) and a riskware tool. Originally designed as an automated assistant... |
| roboinstall | Advanced Threat | 1 | <h3>Executive Summary</h3> RoboInstall is an aggressive software bundler and Potentially Unwanted Program (PUP) installer. It is designed to maximize affiliate ... |
| scramupx | Advanced Threat | 1 | <h3>Executive Summary</h3> ScramUPX is a highly specialized malware packing and obfuscation utility. It is designed to take an executable file that has already ... |
| silentinstall | Advanced Threat | 1 | <h3>Executive Summary</h3> "SilentInstall" (often flagged generically as Adware.SilentInstall or PUP.Installer) refers to a class of Potentially Unwanted Progra... |
| stegvob | Ransomware | 1 | <h3>Executive Summary</h3> Stegvob is a highly sophisticated Trojan designed to covertly infiltrate Windows systems, establish deep persistence, and act as a hi... |
| tick | Backdoor | 1 | <h3>Executive Summary</h3> Tick (also known as Bronze Butler, REDBALDknight, or Stalker Panda) is a highly sophisticated Advanced Persistent Threat (APT) group ... |
| vbcode | Ransomware | 1 | <h3>Executive Summary</h3> VBCode is a general classification given to malicious scripts or Trojans written entirely or predominantly in Visual Basic Script (VB... |
| vixenpanda | Backdoor | 1 | <h3>Executive Summary</h3> Vixen Panda (also widely tracked by the cybersecurity community as APT15, Ke3chang, and Playful Dragon) is a highly sophisticated, st... |
| webdial | Advanced Threat | 1 | <h3>Executive Summary</h3> Webdial is a classic example of legacy malware classified as a "Dialer." Highly prevalent during the era of dial-up internet access, ... |
| webisida | Advanced Threat | 1 | <h3>Executive Summary</h3> Webisida is an automated web surfing and traffic exchange application widely classified by enterprise security vendors as Riskware, a... |
| werpoapt | Backdoor | 1 | <h3>Executive Summary</h3> WerpoAPT is a sophisticated Advanced Persistent Threat (APT) group and associated malware framework characterized by highly targeted ... |