PowerShell

Summary

Running malicious PowerShell commands and scripts, often in memory to evade disk-based detection.

Tactics

Tracked actors using this technique (3)

• OilRigIran (state-aligned)Espionage
• MuddyWaterIran (MOIS-linked)Espionage
• APT33Iran (state-aligned)Espionage

Reference