T1059.001 PowerShell in real malware

ATT&CK technique T1059.001 PowerShell appears in 350 publicly analyzed samples on MalwareAnalyzer by Cyble, 0.3% of the analyzed corpus. Seven-day prevalence is rising (123 recent vs 81 prior). Most associated families: Base64, Avlj, AgentTesla, HUILoader.

Tactics: execution

Prevalence in the corpus

• Samples exhibiting T1059.001: 350
• Share of analyzed corpus: 0.3%
• Last 7 days: 123 · prior 7 days: 81 (rising)

Malware families using T1059.001

• Base64 - 16 samples
• Avlj - 11 samples
• AgentTesla - 9 samples
• HUILoader - 9 samples

Example samples

• ad99ef17b3d55f87d57a84f27adcd7ae48cd73dbda21e9323d83980c042572e0 - malicious
• 9a7a12a7d1ad5db2dcdfedd6cf47d6a7fa4a456e714e8a35900551c1b4288e84 - malicious
• 8b89fdf7c7909848e69002fd4212e9649a8db8aa2c974c365e56860a7a08aaf7 - malicious
• a01d8679920e6f80168733af8507f84ed7ccebb41652b1bc9e410e13e0acf7e0 - malicious
• 040fbc941865d1f2fcae8f51a4848f35daea29ea881611af3f7b55f6887cdfd5 - malicious
• e1267ac21ecbf34f7601c33b7b60c840fc459e3de54a8db2568c227ee340cb87 - malicious
• aa54be78a4d7d8c49138b5d4de8b7bbab3e739ede5a557109a15e301c4e5ad28 - malicious
• c69b9433f8d09671099d736b593d8a1f7430f8c8325a95255e22c28a3e331a77 - malicious
• b1395c031dde2994c40bba91476bcce0357ea357772d9084d1412a606b51505d - malicious
• 5f1881a98712a536b3b9348ec351567cd2f01b7d8f7d55c4e9cf166a37e8b15a - malicious
• e60a59d3ebef63d7d53ad0ec3a1aede663cb3946d5032eb43fc02f9c97d798a9 - malicious
• c0f8204deafadd188e82e1c623be52f70a5bad0b544c3cd257d229b8c06a5bf2 - malicious
• f3dbc086a3e96c7a68d89b8ea54738d4cd0acfe70185b7f8e8a5f2ae8130832c - malicious
• 4c0d18224e45ff328ca8093de6f534734d8d6c5c07c2db522c9677a63762f2ca - malicious
• 1cac1f352efdb0c1d638cd32f7e3de5ed85273c60b54384c586b537638771730 - malicious
• 42e73963eb434e600a9631f2e161562b6de2178e522b07b26adf3ee6cd38c26d - malicious
• 191ec88a8ef8636c3623ce75f2a65760b0a66c4d69e28e4108026d3ce26ba812 - malicious
• af13810dfbfe5277227e9c5f90d3ff9487f2b5ed5c43b6b837ff0a4389cd49b6 - malicious
• dc0f46cb2bd9c0d29f40bc2a6da2b8f2a077b32b2c181b9cd7fcd099668714a8 - malicious
• 66c8041d27975655f2a1bb1b42e454ad51a0e4e93dfbbf765fb995afdeaa40d0 - malicious
• Aurora15Connector.exe - malicious
• 5b74a03d9079f060f77d89adfb7a2af12f12e5792de37e33520d07bc071728d0 - malicious
• d8eb68b269f792a84252096db5dd7e286859edc3cb7da30d775e02fc3236f165 - malicious
• 2c7f003b3c86a15c25f1d01aeea257a3cf70dca61d721b11036f7917c47e2f11 - malicious
• 296fa7d869009b88b0638c32a8255ac5bf0c12b6f3863ece179f2c1a0a074787 - malicious

Canonical technique definition: MITRE ATT&CK T1059.001 (ATT&CK v19.1, CC BY 4.0).

Frequently asked about T1059.001

How common is ATT&CK T1059.001 (PowerShell) in real malware?

ATT&CK technique T1059.001 PowerShell appears in 350 publicly analyzed samples on MalwareAnalyzer by Cyble, 0.3% of the analyzed corpus. Seven-day prevalence is rising (123 recent vs 81 prior). Most associated families: Base64, Avlj, AgentTesla, HUILoader.

Is T1059.001 becoming more common?

Prevalence is rising: 123 samples in the last seven days against 81 in the seven days before. This measures submissions to MalwareAnalyzer by Cyble, so it reflects what is being submitted here rather than global attacker behaviour.

Which malware families use T1059.001?

In this corpus T1059.001 is most associated with Base64 (16), Avlj (11), AgentTesla (9), HUILoader (9). Counts are analyzed samples per family in which the technique was observed.

What share of analyzed samples use T1059.001?

0.3% of the publicly analyzed corpus (350 of 100981 samples) exhibits T1059.001. Technique attribution comes from behavior captured during real sandbox detonation and from static analysis, not from a vendor label.

All ATT&CK techniques in the corpus · Latest analyzed threats