T1059.001: PowerShell

Execution Intelligence Profile

AI Answer

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the <code>Start-Process</code> cmdlet which can be used to run an (Source: MITRE ATT&CK T1059.001)

Confidence: 0.9 · Source: MITRE ATT&CK · Requires review: yes · Freshness: 2026-09-07

ATT&CK Mapping

Field	Value
Technique ID	T1059.001
Name	PowerShell
Tactic	Execution (execution)
Platforms	Windows
Sub-technique	Yes

Why it matters

In the OpenTrojan knowledge graph, PowerShell (T1059.001) is one of the highest-connectivity ATT&CK techniques: 233 MITRE STIX relationships reference this technique; 85 threat groups observed using it; 131 software families associated; 17 campaigns associated. These counts are derived from MITRE ATT&CK STIX relationships and are not an estimate of exploitation volume.

How attackers use it

Behavior described below is from the MITRE ATT&CK canonical definition (source: https://attack.mitre.org/techniques/T1059/001). Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the Start-Process cmdlet which can be used to run an executable and the Invoke-Command cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems). PowerShell may also be used to download and run executables from the Internet, which can be executed from disk or in memory without touching disk. A number of PowerShell-based offensive testing tools are available, including Empire, PowerSploit, PoshC2, and PSAttack. PowerShell commands/scripts can also be executed without directly invoking the powershell.exe binary through interfaces to PowerShell’s underlying System.Management.Automation assembly DLL exposed through the .NET framework and Windows Common Language Interface (CLI).

Detection

DET0455 Abuse of PowerShell for Arbitrary Execution AN1252 Detects behavioral chains where PowerShell is launched with encoded commands, unusual parent processes, or suspicious modules loaded, potentially followed by network connections or child process spawning. Supports detection of both direct (powershell.exe) and indirect (.NET automation) invocations.

Detection strategy text is from the MITRE ATT&CK official technique page (https://attack.mitre.org/techniques/T1059/001).

Mitigation

Prevent the execution of unauthorized or malicious code on systems by implementing application control, script blocking, and other execution prevention mechanisms. This ensures that only trusted and authorized code is executed, reducing the risk of malware and unauthorized actions. This mitigation can be implemented through the following measures:

Application Control:

Use Case: Use tools like AppLocker or Windows Defender Application Control (WDAC) to create whitelists of authorized applications and block unauthorized ones. On Linux, use tools like SELinux or AppArmor to define mandatory access control policies for application execution.
Implementation: Allow only digitally signed or pre-approved applications to execute on servers and endpoints. (e.g., New-AppLockerPolicy -PolicyType Enforced -FilePath "C:\Policies\AppLocker.xml")

Script Blocking:

Use Case: Use script control mechanisms to block unauthorized execution of scripts, such as PowerShell or JavaScript. Web Browsers: Use browser extensions or settings to block JavaScript execution from untrusted sources.
Implementation: Configure PowerShell to enforce Constrained Language Mode for non-administrator users. (e.g., Set-ExecutionPolicy AllSigned)

Executable Blocking:

Use Case: Prevent execution of binaries from suspicious locations, such as %TEMP% or %APPDATA% directories.
Implementation: Block execution of .exe, .bat, or .ps1 files from user-writable directories.

Dynamic Analysis Prevention:

Use Case: Use behavior-based execution prevention tools to identify and block malicious activity in real time.
Implemenation: Employ EDR solutions that analyze runtime behavior and block suspicious code execution.

Mitigation guidance is from the MITRE ATT&CK course-of-action associated with this technique.

TrickBot
Bumblebee
GRIFFON
POWRUNER
SharpStage
Sardonic
HALFBAKED
TAMECAT
PS1
Ursnif
RansomHub
POWERSOURCE

Software associations are from MITRE ATT&CK STIX relationships (observed usage, not attribution).

APT38
Indrik Spider
BlackByte
GALLIUM
APT3
Kimsuky
Volt Typhoon
Patchwork
APT41
Dragonfly
Gorgon Group
menuPass

Group associations are from MITRE ATT&CK STIX relationships.

Operation Dream Job
SharePoint ToolShell Exploitation
Frankenstein
RedDelta Modified PlugX Infection Chain Operations
Triton Safety Instrumented System Attack
C0018
C0021
Juicy Mix
HomeLand Justice
C0032
SolarWinds Compromise
Pikabot Distribution February 2024

Campaign associations are from MITRE ATT&CK STIX relationships.

References

Source Attribution

Source: MITRE ATT&CK (MITRE ATT&CK) · Confidence: 0.9 · Reviewed: OpenTrojan - Human Review

Start Investigation

Move from reading to investigating T1059.001 PowerShell. The workspace is a structured analysis surface — not a chat — organised as:

Question — what do you need to know about T1059.001 PowerShell?
Evidence — assertions mapped to verifiable references.
Timeline — events in chronological order.
Related Entities — CVE, threat actor, campaign, malware links.
Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.
Notes — your own observations and working hypotheses.

AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.

Start Investigation Open Workspace