Home Security Windows PowerShell threats on the rise: Symantec

Windows PowerShell threats on the rise: Symantec

Malicious scripts written using the Windows PowerShell framework are on the increase, Symantec has warned after a study by researchers found that 95% of analysed scripts fell into this category.

Threat researcher Candid Wueest said attackers were using the framework’s flexibility to download their payloads, move through a compromised network, and carry out reconnaissance.

Symantec analysed PowerShell malware samples to find out how much of a danger they posed.

Of all of the PowerShell scripts analysed through the BlueCoat Malware Analysis sandbox, 95.4% were malicious. "This shows that externally sourced PowerShell scripts are a major threat to enterprises," Wueest said.

PowerShell is a framework based on .NET. It offers a command-line shell and a scripting language for automating and managing tasks. PowerShell provides full access to system functions like Windows Management Instrumentation (WMI) and Component Object Model (COM) objects.

In addition, it has management features for many other functions such as the Microsoft Exchange server, virtual environments like VMware, or Linux environments. The framework became open source in 2016 and is also available for non-Windows platforms.

Wueest said attackers were using PowerShell because it provided easy access to all major functions of the Windows operating system.

"There are PowerShell scripts for nearly every task, from creating a network sniffer to reading out passwords. Some threats, such as Trojan.Kotver, even attempt to download the PowerShell framework if it isn’t installed on the compromised computer," a detailed research paper from Symantec said.

"Many recent targeted attacks have used PowerShell scripts. For example, the Odinaff group used malicious PowerShell scripts when it attacked financial organisations worldwide," Wueest said. "Common cybercriminals are leveraging PowerShell as well, such as the attackers behind Trojan.Kotver, who use the scripting language to create a fileless infection completely contained in the registry."

PowerShell is installed by default on most Windows computers, and most organisations do not have extended logging enabled for the framework. These two factors make PowerShell a favoured attack tool. Furthermore, scripts can easily be obfuscated and allow for payloads to be executed directly from memory.

The most prevalent malware families that currently use PowerShell are:

  • W97M.Downloader (9.4% of all analysed samples)
  • Trojan.Kotver (4.5%)
  • JS.Downloader (4.0%)

These three threats have been distributed in spam emails.


Did you know: 1 in 10 mobile services in Australia use an MVNO, as more consumers are turning away from the big 3 providers?

The Australian mobile landscape is changing, and you can take advantage of it.

Any business can grow its brand (and revenue) by adding mobile services to their product range.

From telcos to supermarkets, see who’s found success and learn how they did it in the free report ‘Rise of the MVNOs’.

This free report shows you how to become a successful MVNO:

· Track recent MVNO market trends
· See who’s found success with mobile
· Find out the secret to how they did it
· Learn how to launch your own MVNO service


Sam Varghese

website statistics

A professional journalist with decades of experience, Sam for nine years used DOS and then Windows, which led him to start experimenting with GNU/Linux in 1998. Since then he has written widely about the use of both free and open source software, and the people behind the code. His personal blog is titled Irregular Expression.