Skip to content

PowerSploit

Software · ATTACK:enterprise:S0194

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:S0194",
  "title": "PowerSploit",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0194",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "tool--13cd9151-83b7-410d-9f98-25d0f0d1d80d",
  "external_id": "S0194",
  "domain": "enterprise",
  "created": "2018-04-18T17:59:24.739Z",
  "modified": "2025-04-16T20:38:50.246Z",
  "version": "1.6",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "PowerShellMagazine PowerSploit July 2014",
      "url": "http://www.powershellmagazine.com/2014/07/08/powersploit/"
    },
    {
      "source_name": "GitHub PowerSploit May 2012",
      "url": "https://github.com/PowerShellMafia/PowerSploit"
    },
    {
      "source_name": "PowerSploit Documentation",
      "url": "http://powersploit.readthedocs.io"
    }
  ]
}

Explicit source assertions (39)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:C0004 → uses → ATTACK:enterprise:S0194

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--01bd79bd-651b-46f4-8a2e-dbbedd76f213

BlackBerry CostaRicto November 2020

ATTACK:enterprise:S0194 → uses → ATTACK:enterprise:T1574.007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--088d703a-f321-48d2-8090-12fc8179c6ff

GitHub PowerSploit May 2012 · PowerSploit Documentation

ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:S0194

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--148d82d9-c55b-4ce4-adb2-79387dab01ab

FireEye APT33 Guardrail

ATTACK:enterprise:S0194 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1bd467ff-6e94-40c5-ae4d-2ed7c62bc0d5

GitHub PowerSploit May 2012 · PowerSploit Documentation

ATTACK:enterprise:S0194 → uses → ATTACK:enterprise:T1620

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1da7a099-122d-4c26-b27f-f8acabdd7b44

GitHub PowerSploit May 2012 · PowerSploit Documentation

ATTACK:enterprise:S0194 → uses → ATTACK:enterprise:T1552.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--216b3711-fc70-4029-aaec-a8f021c38bef

Pentestlab Stored Credentials

ATTACK:enterprise:S0194 → uses → ATTACK:enterprise:T1027.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--26eca19b-1c55-49b5-8a07-a4131c577874

GitHub PowerSploit May 2012 · PowerSploit Documentation

ATTACK:enterprise:S0194 → uses → ATTACK:enterprise:T1123

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2a32c434-c3ef-42ee-a0b6-c64c589355c3

GitHub PowerSploit May 2012 · PowerSploit Documentation

ATTACK:enterprise:S0194 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2d2ebfcb-0b2c-4c69-877e-2ca633c95a17

GitHub PowerSploit May 2012 · PowerSploit Documentation

ATTACK:enterprise:S0194 → uses → ATTACK:enterprise:T1574.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2e202038-196d-41c7-8fdf-27b4fcf88830

GitHub PowerSploit May 2012 · PowerSploit Documentation

ATTACK:enterprise:S0194 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--312c929a-abf6-44c1-95d6-6dde60c7a3fe

GitHub PowerSploit May 2012 · PowerSploit Documentation

ATTACK:enterprise:S0194 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--31334bcb-0207-41c8-b04a-96c7d6d1a466

GitHub PowerSploit May 2012 · PowerSploit Documentation

ATTACK:enterprise:S0194 → uses → ATTACK:enterprise:T1552.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3837e91f-47d5-4b30-b11b-76a91450c4ef

GitHub PowerSploit May 2012 · PowerSploit Documentation

ATTACK:enterprise:G1006 → uses → ATTACK:enterprise:S0194

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--427f7417-6d8a-4b0b-8bcf-a6acdd28586e

TrendMicro EarthLusca 2022

ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:S0194

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--48c34dc3-0c3f-426d-b99a-b72e595da287

FireEye APT41 Aug 2019

ATTACK:enterprise:S0194 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4bcd21d2-7583-4b82-8d33-2b153eeb6fdb

GitHub PowerSploit May 2012 · PowerSploit Documentation

ATTACK:enterprise:S0194 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4d8df710-e1a4-4069-afef-2e8e63ed6587

GitHub PowerSploit May 2012 · PowerSploit Documentation

ATTACK:enterprise:S0194 → uses → ATTACK:enterprise:T1134

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--56b59fda-e96d-443d-9f45-e4cc967c911a

GitHub PowerSploit May 2012 · PowerSploit Documentation

ATTACK:enterprise:G0069 → uses → ATTACK:enterprise:S0194

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--649748ff-e2d0-4369-8f5d-3c8b5b5010ed

TrendMicro POWERSTATS V3 June 2019

ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:S0194

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--65376085-302c-4958-94b7-3582e30a3c0f

FoxIT Wocao December 2019

ATTACK:enterprise:S0194 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--676d7d2c-86b6-4a59-8158-d371e5ca4f23

GitHub PowerSploit May 2012 · PowerSploit Documentation

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:S0194

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6afed42c-6a42-402a-8964-7fcde5435336

Mandiant FIN7 Apr 2022 · CrowdStrike Carbon Spider August 2021

ATTACK:enterprise:S0194 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--792c5ad3-87ca-473f-998b-654f29a5b10f

GitHub PowerSploit May 2012 · PowerSploit Documentation

ATTACK:enterprise:S0194 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7b06929c-1b23-4efc-9fc1-64552d5fbdb2

GitHub PowerSploit May 2012 · PowerSploit Documentation

ATTACK:enterprise:G0045 → uses → ATTACK:enterprise:S0194

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--80d72d09-c1a4-4735-b85a-28bfc19ef8b9

PWC Cloud Hopper Technical Annex April 2017

ATTACK:enterprise:S0194 → uses → ATTACK:enterprise:T1053.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--91c5d713-a89c-49fa-92eb-abaf18fae988

GitHub PowerSploit May 2012 · PowerSploit Documentation

ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:S0194

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--962f1bc9-89f8-4fbe-b981-b63cce196cbf

CISA AA21-200A APT40 July 2021

ATTACK:enterprise:S0194 → uses → ATTACK:enterprise:T1574.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9bdcaf47-0df8-44a5-ac10-3f0a806a36f3

GitHub PowerSploit May 2012 · PowerSploit Documentation

ATTACK:enterprise:S0194 → uses → ATTACK:enterprise:T1574.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9d038aa7-af97-4f60-ad5c-f74d20200c18

GitHub PowerSploit May 2012 · PowerSploit Documentation

ATTACK:enterprise:S0194 → uses → ATTACK:enterprise:T1558.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aaa0e944-7158-4baa-b45b-c687f7b161b5

Harmj0y Kerberoast Nov 2016 · PowerSploit Invoke Kerberoast

ATTACK:enterprise:S0194 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b70e19d8-9602-4795-9d9b-ef18cdbe5d51

GitHub PowerSploit May 2012 · PowerSploit Documentation

ATTACK:enterprise:S0194 → uses → ATTACK:enterprise:T1547.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--be2d0ead-f24c-4b76-bdd9-695d163bcbf3

GitHub PowerSploit May 2012 · PowerSploit Documentation

ATTACK:enterprise:S0194 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c1cbaa0f-59d2-4b49-a91f-c21bff7ca009

GitHub PowerSploit May 2012 · PowerSploit Documentation

ATTACK:enterprise:S0194 → uses → ATTACK:enterprise:T1555.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--da4e4583-7382-4a38-a922-9b5f6c61b8a7

GitHub PowerSploit May 2012 · PowerSploit Documentation

ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:S0194

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e3c860e4-c981-4a9a-8a8e-8ba0207f834b

NCC Group TA505

ATTACK:enterprise:S0194 → uses → ATTACK:enterprise:T1059.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e7df8e8c-dfc4-48f2-bbd3-46b2572d60ca

GitHub PowerSploit May 2012 · PowerSploit Documentation

ATTACK:enterprise:S0194 → uses → ATTACK:enterprise:T1482

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ee2068ec-c520-476e-979f-3dea201d0b9e

GitHub PowerSploit May 2012 · PowerSploit Documentation

ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:S0194

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f07267d5-f532-4a52-abd6-20d5f94a2bf8

Cymmetria Patchwork

ATTACK:enterprise:S0194 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fa717a25-6be4-4cfd-ba02-1adc633f80ba

GitHub PowerSploit May 2012 · PowerSploit Documentation

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.