PowerShell
Subtechnique · ATTACK:ics:T1701.001
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:ics:T1701.001",
"title": "PowerShell",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1701/001",
"snapshot": "ics-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--e3496d05-0826-4187-a993-80f29aa5a40a",
"external_id": "T1701.001",
"domain": "ics",
"created": "2026-09-25T18:09:28.846Z",
"modified": "2026-10-09T17:14:23.887Z",
"version": "1.0",
"aliases": [
],
"tactics": [
"execution"
],
"source_references": [
{
"source_name": "Microsoft PSfromCsharp APR 2014",
"url": "https://blogs.msdn.microsoft.com/kebab/2014/04/28/executing-powershell-scripts-from-c/"
},
{
"source_name": "SilentBreak Offensive PS Dec 2015",
"url": "https://web.archive.org/web/20190508170150/https://silentbreaksecurity.com/powershell-jobs-without-powershell-exe/"
},
{
"source_name": "TechNet PowerShell",
"url": "https://technet.microsoft.com/en-us/scriptcenter/dd742419.aspx"
},
{
"source_name": "Sixdub PowerPick Jan 2016",
"url": "https://web.archive.org/web/20160327101330/http://www.sixdub.net/?p=367"
}
]
}Explicit source assertions (13)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:ics:M0945 → mitigates → ATTACK:ics:T1701.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--00cc557e-e1a7-4fdd-b626-2efc73fe510b
ATTACK:ics:M0926 → mitigates → ATTACK:ics:T1701.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--283d4fdb-f5db-4947-85d6-80b5de55d0c0
ATTACK:ics:M0950 → mitigates → ATTACK:ics:T1701.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2de9fc26-3c9b-4ecf-b613-795586f5414b
ATTACK:ics:M0938 → mitigates → ATTACK:ics:T1701.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--31402349-2c5a-4811-addd-a345801836ac
ATTACK:ics:T1701.001 → subtechnique-of → ATTACK:ics:T1701
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--67a85278-577c-4e8a-a668-83f43edb9742
ATTACK:ics:S0496 → uses → ATTACK:ics:T1701.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--72a284ef-1b88-40b1-8ab0-af6e2911f7cd
Tom Fakterman August 2019ATTACK:ics:G0064 → uses → ATTACK:ics:T1701.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--881abd90-78d3-4f25-ab87-e7e8b031c98d
Dragos · Symantec March 2019ATTACK:ics:C0030 → uses → ATTACK:ics:T1701.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8af19674-6836-4d21-abfc-593252b282cb
FireEye TEMP.Veles 2018ATTACK:ics:M0942 → mitigates → ATTACK:ics:T1701.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8e29dea4-1176-4fd8-8c73-6f5bccc7ec5e
ATTACK:ics:C0025 → uses → ATTACK:ics:T1701.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c7ab3b87-4a54-4a24-9ed0-1ed360c3e03e
Dragos Crashoverride 2018ATTACK:ics:G0034 → uses → ATTACK:ics:T1701.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c8385036-b439-4360-8a56-cb595511e239
Dragos October 2018ATTACK:ics:C0063 → uses → ATTACK:ics:T1701.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d9d6acfe-c905-41fd-9e29-8c3b047e4916
CERT PolskaATTACK:ics:G0049 → uses → ATTACK:ics:T1701.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dc4ea40d-059d-4952-a525-5f915c7f23ba
Robert Falcone, Bryan Lee May 2016