Search/PoshC2
● Malware

PoshC2

PoshC2 is an open source remote administration and post-exploitation framework that is publicly available on GitHub. The server-side components of the tool are primarily written in Python, while the implants are written in PowerShell. Although PoshC2 is primarily focused on Windows implantation, it does contain a basic Python dropper for Linux/macOS.

View graph Watch Export
Indicators tracked
4
View 4 indicators
Intelligence Reports10
10 intelligence reports available

Curated threat research and citations from CrowdStrike, Mandiant, Microsoft, and other sources — unlock with Premium.

Upgrade to Premium
Connections
39 relationships
T1560.001: Archive via Utility
source
T1047: Windows Management Instrumentation
source
T1056.001: Keylogging
source
T1548.002: Bypass User Account Control
source
T1087.002: Domain Account
source
T1087.001: Local Account
source
T1119: Automated Collection
source
T1007: System Service Discovery
source
T1040: Network Sniffing
source
T1082: System Information Discovery
source
T1555: Credentials from Password Stores
source
T1055: Process Injection
source
T1557.001: Name Resolution Poisoning and SMB Relay
source
T1003.001: LSASS Memory
source
T1134.002: Create Process with Token
source
T1016: System Network Configuration Discovery
source
T1090: Proxy
source
T1482: Domain Trust Discovery
source
T1083: File and Directory Discovery
source
T1049: System Network Connections Discovery
source
T1552.001: Credentials In Files
source
T1546.003: Windows Management Instrumentation Event Subscription
source
T1210: Exploitation of Remote Services
source
T1069.001: Local Groups
source
T1110: Brute Force
source
T1068: Exploitation for Privilege Escalation
source
T1201: Password Policy Discovery
source
T1134: Access Token Manipulation
source
T1071.001: Web Protocols
source
T1046: Network Service Discovery
source
T1550.002: Pass the Hash
source
T1569.002: Service Execution
source