Gold Open Source
ExplorePackagesVulnerabilitiesCWEsMCP ServersScan
Login
Gold Open Source

The authoritative source for production-ready open-source components. Every package, container image, AI model, and MCP server undergoes rigorous verification for security, malware, and license compliance.

Explore Gold

  • Explore Everything
  • Packages
  • Gold Certified Packages
  • Container Images
  • AI Models
  • MCP Servers
  • Agent Skills
  • Chip Manufacturers

Security Data & Tools

  • Scan Your Dependencies
  • Trending Threats
  • Threat RSS Feeds
  • CVE Database
  • Actively Exploited (KEV)
  • SGZ Zero-Days
  • CWE Index
  • MITRE ATT&CK
  • Malicious Packages
  • Security Glossary
  • Supply-Chain Report
  • Developers (API & Badge)
  • Chrome Extension
  • Credits & Data Sources

Products

  • The Platform
  • ESSCM
  • Portal
  • TPRM
  • OSM
  • Cowork
  • Code / Runner
  • Guard

Use Cases

  • Know Your Software
  • Auto-Fix Vulnerabilities
  • Asset Discovery
  • AI Governance
  • MCP Server Security
  • Supply Chain Compliance
  • Zero-Day Discovery
  • All Use Cases

Company

  • About
  • Pricing
  • Blog
  • Documentation
  • Safeguard Academy
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 Gold Open Source. All rights reserved.

Built with care bySafeguard
Home/ATT&CK/Software/S0194
MITRE ATT&CK Tool

PowerSploit (S0194)

ShareXLinkedInRedditHN

[PowerSploit](https://attack.mitre.org/software/S0194) is an open source, offensive security framework comprised of [PowerShell](https://attack.mitre.org/techniques/T1059/001) modules and scripts that perform a wide range of tasks related to penetration testing such as code execution, persistence, bypassing anti-virus, recon, and exfiltration. (Citation: GitHub PowerSploit May 2012) (Citation: PowerShellMagazine PowerSploit July 2014) (Citation: PowerSploit Documentation)

Platforms: Windows

▪Techniques implemented (28)

T1574.007Path Interception by PATH Environment VariableT1056.001KeyloggingT1620Reflective Code LoadingT1552.002Credentials in RegistryT1027.005Indicator Removal from ToolsT1123Audio CaptureT1047Windows Management InstrumentationT1574.009Path Interception by Unquoted PathT1012Query RegistryT1005Data from Local SystemT1552.006Group Policy PreferencesT1055.001Dynamic-link Library InjectionT1027.010Command ObfuscationT1134Access Token ManipulationT1543.003Windows ServiceT1113Screen CaptureT1547.001Registry Run Keys / Startup FolderT1053.005Scheduled TaskT1574.001DLLT1574.008Path Interception by Search Order HijackingT1558.003KerberoastingT1087.001Local AccountT1547.005Security Support ProviderT1057Process DiscoveryT1555.004Windows Credential ManagerT1059.001PowerShellT1482Domain Trust DiscoveryT1003.001LSASS Memory

▪Used by groups (9)

G0064APT33G1006Earth LuscaG0096APT41G0069MuddyWaterG0046FIN7G0045menuPassG0065LeviathanG0092TA505G0040Patchwork
S0194on MITRE ATT&CK →

MITRE ATT&CK® is a registered trademark of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.