MITRE ATT&CK technique · Privilege Escalation, Persistence

`T1546.013` PowerShell Profile

Sub-technique of T1546 Event Triggered Execution

Adversaries may gain persistence and elevate privileges by executing malicious content triggered by PowerShell profiles. A PowerShell profile (profile.ps1) is a script that runs when [PowerShell](https://attack.mitre.org/techniques/T1059/001) starts and can be used as a logon script to customize user environments. [PowerShell](https://attack.mitre.org/techniques/T1059/001) supports several…

MITRE ATT&CK page ↗

Who uses it · with stories on Jábega

Turla

Sigma rules to hunt it

Potential Persistence Via PowerShell User Profile Using Add-Contentmediumtest · windows
PowerShell Profile Modificationmediumtest · windows
VsCode Powershell Profile Modificationmediumtest · windows

Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.