| ID | Name |
|---|---|
| T1701.001 | PowerShell |
| T1701.002 | Windows Command Shell |
| T1701.003 | Unix Shell |
| T1701.004 | Visual Basic |
| T1701.005 | Python |
| T1701.006 | JavaScript |
Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.[1] Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the Start-Process cmdlet which can be used to run an executable and the Invoke-Command cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
PowerShell may also be used to download and run executables from the Internet, which can be executed from disk or in memory without touching disk.
PowerShell commands/scripts can also be executed without directly invoking the powershell.exe binary through interfaces to PowerShell's underlying System.Management.Automation assembly DLL exposed through the .NET framework and Windows Common Language Interface (CLI).[2][3][4]
Within industrial control system networks, adversaries may abuse the use of PowerShell on overlap assets that run on Microsoft Windows operating systems (Workstations, Data Historians, Human Machine Interfaces, Application Servers, Jump Hosts, etc.).
| ID | Name | Description |
|---|---|---|
| C0025 | 2016 Ukraine Electric Power Attack |
During the 2016 Ukraine Electric Power Attack, Sandworm Team utilized VBS and batch scripts for file movement and as wrappers for PowerShell execution.[5] |
| C0063 | 2025 Poland Wiper Attacks |
During the 2025 Poland Wiper Attacks, the adversaries executed PowerShell commands on the Human Machine Interface (HMI) to make configuration changes that enabled administrative shares and created a new firewall rule to enable traffic over port 445 as well as conducted network reconnaissance activities.[6] During the 2025 Poland Wiper Attacks, the adversaries executed PowerShell commands on the domain controller that collected and exfiltrated the SAM and SYSTEM registry hives and the Active Directory database (ntds.dit).[6] |
| G0064 | APT33 |
APT33 utilized PowerShell scripts to establish command and control and install files for execution. [7] [8] |
| G0049 | OilRig |
OilRig has embedded a macro within spearphishing attachments that has been made up of both a VBScript and a PowerShell script.[9] |
| S0496 | REvil |
REvil utilizes JavaScript, WScript, and PowerShell scripts to execute. The malicious JavaScript attachment has an obfuscated PowerShell script that executes the malware. [10] |
| G0034 | Sandworm Team |
Sandworm Team uses the MS-SQL server xp_cmdshell command, and PowerShell to execute commands. [11] |
| C0030 | Triton Safety Instrumented System Attack |
In the Triton Safety Instrumented System Attack, TEMP.Veles used a publicly available PowerShell-based tool, WMImplant.[12] |
| ID | Mitigation | Description |
|---|---|---|
| M0945 | Code Signing |
Require signed PowerShell scripts where operationally feasible and restrict execution of unsigned or untrusted scripts on ICS Windows assets. Maintain explicit exceptions for validated vendor and engineering automation. |
| M0942 | Disable or Remove Feature or Program |
Where PowerShell is not required for the documented function of an ICS asset, disable or remove access to it. Do not apply this control to systems where vendor support, engineering workflows, backup, patching, or approved automation depend on PowerShell. |
| M0938 | Execution Prevention |
Use application control/allowlisting to restrict PowerShell hosts, script paths, interpreters, and child-process behavior to approved engineering and operational workflows. Prefer explicit allowlists over broad blocking on production OT systems. |
| M0950 | Exploit Protection |
Use supported exploit-protection controls on Windows-based ICS overlap assets to reduce execution paths commonly used to launch or inject PowerShell-driven payloads. Validate compatibility with HMI, historian, engineering, and vendor applications before enforcement. |
| M0926 | Privileged Account Management |
Restrict privileged PowerShell use to authorized engineering and administrative accounts and controlled access paths. Separate routine operator activity from privileged maintenance and engineering functions. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0929 | Behavioral Detection of PowerShell Execution in ICS | AN2086 |
Real-time monitoring identifies direct PowerShell execution or indirect System.Management.Automation use with an unexpected parent, encoded/obfuscated arguments, unusual module loading, or execution followed by OT-relevant network/process activity. Alert only when the interpreter is not part of the asset's approved software/automation baseline or its execution context violates an approved signer/hash/path/parent/user rule, and require OT-relevant corroboration such as access to engineering files, ICS software/API use, communications with protected OT assets, configuration change, or another suspicious follow-on behavior. Suppress documented vendor software, engineering workflows, diagnostics, backup, patching, and approved maintenance. |