What MITRE ATT&CK T1059.001: PowerShell (Sub-Technique of T1059 - Execution) requires
MITRE ATT&CK T1059.001 covers adversary abuse of PowerShell for execution, lateral movement, and discovery. PowerShell is the dominant living-off-the-land interpreter on Windows: every modern ransomware operator (LockBit, BlackCat, Cl0p, Akira, Royal) uses PowerShell for at least one stage. Empire, PoshC2, Nishang, PowerSploit, and Cobalt Strike provide weaponised PowerShell payloads. Compliance obligations include NIST SP 800-53 SI-7 (Software Integrity), CM-7 (Least Functionality), SI-3 (Malicious Code Protection), AU-2 (Event Logging), ISO 27001 A.8.19, A.8.16, PCI DSS Req 10.4, and CIS Microsoft Windows Server Benchmark.
Pillar: Cybersecurity · Authority: MITRE Corporation · Version: 1.0.0 · Last updated:
Primary source: https://attack.mitre.org/techniques/T1059/001/
SHA-256 integrity: 0700bb98051ce56f586289288dcb2035865ec14fa6cec8af744e389de6caecaa
Primary Citations — 8 traced to source
- MITRE ATT&CK Technique T1059.001: PowerShell (https://attack.mitre.org/techniques/T1059/001/)
- NIST SP 800-53 Rev 5: SI-7 (Software Integrity), CM-7 (Least Functionality)
+ 6 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access
- Discovery (free): /api/v1/nodes/mitre-attack-t1059-001-powershell.json — 6-field metadata
- Vault (full node): /api/v1/vault/nodes/mitre-attack-t1059-001-powershell.json — full 13-key payload, $0.01 USDC (L402/Skyfire/Direct Base)
- Canonical URL: https://bidda.com/intelligence/mitre-attack-t1059-001-powershell
- Back to registry: Browse all 10,085 compliance nodes