Threat researcher Candid Wueest said attackers were using the framework’s flexibility to download their payloads, move through a compromised network, and carry out reconnaissance.

Symantec analysed PowerShell malware samples to find out how much of a danger they posed.

Of all of the PowerShell scripts analysed through the BlueCoat Malware Analysis sandbox, 95.4% were malicious. "This shows that externally sourced PowerShell scripts are a major threat to enterprises," Wueest said.

PowerShell is a framework based on .NET. It offers a command-line shell and a scripting language for automating and managing tasks. PowerShell provides full access to system functions like Windows Management Instrumentation (WMI) and Component Object Model (COM) objects.

In addition, it has management features for many other functions such as the Microsoft Exchange server, virtual environments like VMware, or Linux environments. The framework became open source in 2016 and is also available for non-Windows platforms.

Wueest said attackers were using PowerShell because it provided easy access to all major functions of the Windows operating system.

"There are PowerShell scripts for nearly every task, from creating a network sniffer to reading out passwords. Some threats, such as Trojan.Kotver, even attempt to download the PowerShell framework if it isn’t installed on the compromised computer," a detailed research paper from Symantec said.

"Many recent targeted attacks have used PowerShell scripts. For example, the Odinaff group used malicious PowerShell scripts when it attacked financial organisations worldwide," Wueest said. "Common cybercriminals are leveraging PowerShell as well, such as the attackers behind Trojan.Kotver, who use the scripting language to create a fileless infection completely contained in the registry."

PowerShell is installed by default on most Windows computers, and most organisations do not have extended logging enabled for the framework. These two factors make PowerShell a favoured attack tool. Furthermore, scripts can easily be obfuscated and allow for payloads to be executed directly from memory.

The most prevalent malware families that currently use PowerShell are:

• W97M.Downloader (9.4% of all analysed samples)
• Trojan.Kotver (4.5%)
• JS.Downloader (4.0%)

These three threats have been distributed in spam emails.