PowerSploitTool
PowerSploit is an open source, offensive security framework comprised of PowerShell modules and scripts that perform a wide range of tasks related to penetration testing such as code execution, persistence, bypassing anti-virus, recon, and exfiltration.From MITRE ATT&CK
Last reported 3 months ago, by Huntress4 reports
ATT&CK techniques
6 of 51 · each with the sentence it comes from- T1053.005Scheduled Task
“Scheduled task name:”
- T1003.001LSASS Memory
“LSASS Memory - T1003.001”
- T1003.003NTDS
“NTDS - T1003.003”
- T1018Remote System Discovery
“Remote System Discovery - T1018”
- T1021.001Remote Desktop Protocol
“Remote Desktop Protocol - T1021.001”
- T1021.003Distributed Component Object Model
“Distributed Component Object Model - T1021.003”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
4 reports, newest first · the exact sentence from each-
AI-Coded Malware | Analyzing Vibe-Coded AD Enumeration“For years, defenders have relied on identifying the signatures and behaviors of off-the-shelf offensive tooling, like BloodHound, PowerSploit, or Cobalt Strike.”
-
From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira“It was originally developed as part of the PowerView module within the PowerSploit framework, but has since been integrated into numerous offensive projects.”
-
Velociraptor WSUS Exploitation, Pt. I: WSUS-Up?“… previously been misused in attacks include dual-use penetration testing frameworks, such as Cobalt Strike, Mimikatz, Metasploit, and PowerSploit, as highlighted in the Huntress 2025 Cyber Threat Report.”
-
Dark Pink“During our investigation, we noticed only one public tool: PowerSploit/Get-MicrophoneAudio.”
Indicators in its reports
named in the reports above- opmanager[.]proin 1 report
- zenmap[.]proin 1 report
- download-server[.]onlinein 1 report
- soft-server[.]onlinein 1 report
- soft-hub[.]proin 1 report
- hxxps://tria[.]ge/250530-ttmjhayzhwin 1 report
- tria[.]gein 1 report
- hxxps://tria[.]ge/250812-zw4tfszpy4in 1 report
- netml[.]shopin 1 report
- shopping5[.]shopin 1 report
- 84.32.84[.]32in 1 report
- 4.239.95[.]1in 1 report
- ip-scanner[.]orgin 1 report
- certgraveyard[.]orgin 1 report
- 170.130.55[.]223in 1 report
- delete[.]mein 1 report
- 188.40.187[.]145in 1 report
- 109.205.195[.]211in 1 report
- ev2sirbd269o5j[.]orgin 1 report
- 2rxyt9urhq0bgj[.]orgin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.