{
  "family": "psshell",
  "sample_count": 1,
  "category": "ransomware",
  "description": "<h3>Executive Summary</h3>\nPSShell refers to a category of offensive PowerShell scripts and frameworks (such as Nishang or Empire modules) designed to establish a remote, interactive command shell on a compromised Windows system. While PowerShell is a legitimate administrative tool, \"PSShell\" variants are specifically weaponized to evade detection, bypass execution policies, and provide threat actors with a powerful \"Living off the Land\" (LotL) mechanism for post-exploitation, lateral movement, and data exfiltration.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nPSShell scripts are rarely the initial infection vector. They are typically executed by an initial dropper (like a malicious macro) or deployed by an attacker who has already compromised an endpoint via RDP brute-forcing or vulnerability exploitation.\n\nOnce deployed, PSShell frameworks exhibit advanced offensive capabilities:\n<ul>\n<li><strong>Fileless Execution:</strong> PSShells are often executed entirely in memory using \"Download Cradles\" (e.g., `Invoke-Expression (New-Object Net.WebClient).DownloadString(...)`). This allows the attacker to establish a reverse shell without ever writing a `.ps1` script file to the hard drive, evading many traditional antivirus scanners.</li>\n<li><strong>AMSI Evasion:</strong> Modern PSShell frameworks incorporate code specifically designed to hook and bypass the Windows Anti-Malware Scan Interface (AMSI), preventing Windows Defender from scanning the malicious PowerShell commands as they are executed.</li>\n<li><strong>Post-Exploitation Framework:</strong> Once the shell is established, the attacker has unrestricted command-line access to the system. They can utilize built-in PowerShell cmdlets to dump credentials (e.g., Mimikatz modules), enumerate Active Directory, and pivot to other systems on the network.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe detection of an unauthorized PSShell is a critical incident indicating that an attacker has achieved interactive, command-line control over the endpoint. It signifies a mature compromise where the adversary is actively navigating the network and likely preparing for a larger objective, such as ransomware deployment or data theft.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Behavioral Monitoring (EDR and Script Block Logging):</strong> Detection relies heavily on EDR telemetry and Windows Event Log 4104 (Script Block Logging). Analysts must review these logs to reconstruct the commands executed by the attacker during the PSShell session.</li>\n<li><strong>Immediate Network Isolation:</strong> The endpoint must be isolated instantly to severe the reverse shell connection and halt the attacker's lateral movement.</li>\n<li><strong>Total Re-imaging:</strong> Because the attacker had interactive command-line access, they could have established deep, secondary persistence mechanisms (like WMI event subscriptions or modified registry keys) that are difficult to uncover. A complete bare-metal wipe and re-image is required, alongside a global password reset.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "HackTool.PSShell",
    "Riskware.PowerShell",
    "Trojan.PowerShell.ReverseShell",
    "Nishang"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1059.001",
    "T1059",
    "T1562.001",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-02T07:23:02Z",
  "type": "HackTool / Riskware (PowerShell)",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}