Tinker Secor USES PowerShell
Tinker used PowerShell in a reverse-shell payload delivered to another workstation.
Explicit Confidence 99% · Tinker Secor EP 36 Details
“He wrote an executable that will then call my PowerShell, reverse shell.”
Software
software:powershell
Also: Power Shell, PowerShell scripts, power shell
Windows command-line and scripting environment used for the reverse shell and detected as anomalous on a Finance computer.
Windows command-line and scripting environment used for the reverse shell and detected as anomalous on a Finance computer.
“Power Shell is kind of like a super command line tool in Windows”
“you were running PowerShell from a finance computer”
Windows scripting environment used in scripts that performed surveillance inside the company.
“they were like, PowerShell scripts to do stuff.”
Command-line and scripting environment used in the episode’s example of safely testing hacking tools.
“I downloaded a PowerShell tool to see if it actually works”
Microsoft scripting environment mentioned in connection with a requested script.
“he wanted me to write a PowerShell script”
Command and scripting environment used in the episode as a way to execute code on a compromised server.
“launch some power shell codes on the server”
Windows scripting and automation component referenced as something that can be restricted by security policy.
“you stop power shell accessing things”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| incoming | USES | Tinker Secor | Explicit | 36 |
| incoming | USES | Marq | Explicit | 108 |
| incoming | USES | REvil | Explicit | 126 |
Tinker Secor USES PowerShell
Tinker used PowerShell in a reverse-shell payload delivered to another workstation.
Explicit Confidence 99% · Tinker Secor EP 36 Details
“He wrote an executable that will then call my PowerShell, reverse shell.”
Marq USES PowerShell
A coworker asked Marq to write a PowerShell script for a client, although Marq described it as outside his area.
Explicit Confidence 98% · Marq EP 108 Details
“he wanted me to write a PowerShell script for this specific client that was just way out of my zone.”
REvil USES PowerShell
REvil attackers used PowerShell code on compromised servers after exploiting a vulnerability.
Explicit Confidence 96% · Will EP 126 Details
“launch some power shell codes on the server”