To evade detection, malware authors often leverage tools that already exist on the system (such as PowerShell) which allow them to hide their malicious activities. PowerShell is a management engine based on the .NET framework. This engine exposes a series of commands called cmdlets. The engine is hosted in an application and Windows operating system, which by default ships a command-line interface (interactive console) and a GUI PowerShell ISE (Integrated Scripted Environment).

PowerShell is not a programming language, but it allows you to create useful scripts containing multiple commands. You can also open PowerShell prompt and execute individual commands. PowerShell is typically used by the System Administrators for a legitimate purpose. However, there is an increase in the use of PowerShell by the attackers to execute their malicious code. The major reason why attackers use PowerShell is that it provides access to all major operating system functions and it leaves very few traces, thereby making detection more difficult. The following outlines how attackers leverage PowerShell in malware attacks:

• In most cases, Powershell is used post-exploitation to download additional components. It is mostly delivered via email attachments containing files (such as .lnk, .wsf, JavaScript, VBScript, or office documents containing malicious macros) which are capable of executing PowerShell scripts directly or indirectly. Once the attacker tricks the user into opening the malicious attachment, then the malicious code invokes PowerShell directly or indirectly to download additional components.
• It is used in the lateral movement, where the attacker executes code on a remote computer to spread inside the network.
• Attackers use PowerShell to dynamically load and execute code directly from memory without accessing the file system. This allows the attacker to be stealthy and makes forensic analysis much harder.
• Attackers use PowerShell to execute their obfuscated code; this makes it hard to detect it with traditional security tools.