powershell.exe

Windows CMD execution T1059.001

PowerShell executable launched from CMD. Bypasses CMD-level restrictions by delegating to PowerShell runtime.

Binary Paths

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Glob Patterns

Pattern Wildcards Notes
for /f %i in ('where powers*') do %i -nop -w hidden -c IEX(...)
* Star matches 'hell.exe'
for /f %i in ('where power?hell.exe') do %i
? Wildcard replaces 's'
for /f %i in ('where p*hell.exe') do %i
* Star matches 'owers'
for /f %i in ('dir /b C:\Windows\System32\WindowsPowerShell\v1.0\power*.exe') do %i
* Full path dir glob

Resources

← Back to Catalog