PowerSploit

PowerSploit is a legitimate software package that is used by penetration testers worldwide to make sure that the networks of their clients are not vulnerable to specific attacks and exploits. Unfortunately, many legitimate tools are often being misappropriated and weaponized by cybercriminals, and the PowerSploit is not an exclusion – it is being used by high-profile threat actors such as the Patchworks APT and, sadly, it has been involved in attacks against both regular users and large companies or government entities.

The PowerSploit framework works by providing the operator with the ability to launch pre-made PowerShell scripts on the compromised host – these could be used to carry out a wide range of tasks such as execute remote code, gain persistence, bypass firewall or anti-virus products, and even collect data and more. The full list of the PowerShell scripts that the PowerSploit supports allows it to work as a Remote Access Trojan that provides the attacker with unlimited access to the infected computer's resources.

Although being a legitimate tool, anti-virus products are prepared to identify and stop its activity – the PowerShell scripts that this framework uses often tamper with important parts of the operating system, and you can rest assured that any modern anti-virus product will put a stop to this behavior before it gets a chance to cause damage.