powersploit
v3.0.0 open-sourceThe section your link pointed to isn't on powersploit's page any more, so we've brought you to the top.
Collection of PowerShell modules for penetration testers covering code execution, persistence, exfiltration, privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources., and recon.
Summary
PowerSploit is an open-source collection of Microsoft PowerShell modules that penetration testers import into a PowerShell session to aid post-exploitation work on Windows targets. It runs as a library rather than a standalone application: you import the module and call its functions directly from PowerShell, covering code execution (DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. and shellcode injection, reflective PE loading), script obfuscation and encoding, persistence setup, antivirus signature evasion, and exfiltration tasks like credential dumping via Mimikatz and keystroke logging. It's built for red teamers and penetration testers working against Windows environments during live assessments rather than for defenders or SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. analysts. It sits in the post-exploitation tooling space alongside other PowerShell-based offensive frameworks, though its own README states the project is no longer supported, and our records confirm that: no commits in the past year, despite 39 contributors since its first commit in 2012.
Collection of PowerShell modules for penetration testers covering code execution, persistence, exfiltration, privilege escalation, and recon.
How powersploit helps
Can code get running on a target machine without dropping a file to disk first?
reflectively loads a PE, DLL, or shellcode directly into a process's memory, so execution happens without the binary ever touching the target's filesystem
How do I pull credentials off a compromised host without writing anything to disk?
loads Mimikatz reflectively in memory from the PowerShell session and dumps credentials straight to the console
Which security products on this box rely on single-byte signatures I can slip past?
scans binaries the same way DSplit does and reports the single-byte signatures antivirus is matching on
How do I keep access to a machine after the current session ends?
builds a persistence payload with user-level or elevated trigger options and attaches it to a script that re-executes on logon or boot
Can I create a logon with another user's credentials without tripping the usual audit alert?
creates the logon using clear-text credentials through a path that avoids generating the Event ID normally raised for explicit credential logons
What is someone typing on a compromised machine right now?
hooks keyboard input and records each keystroke together with the time and the window that was active
Languages
Command line
| option | found in | since | description |
|---|
Values are placeholders taken from each option’s declared default. Nothing is executed here — the output shown is a recording of a run that already happened.
Release-note detail over time
See how much detail powersploit puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.
Checking release-note history…
Releases
1 entry
No entries match these filters.
- December 20151
Project health
Issue, contributor and maintainer activity in PowerShellMafia/PowerSploit, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.
- Contributors 0 ±0 vs prior 12 months
- Maintainers 0 +0 joined · −0 left, last 12 months
- Bus factor 0 committers behind half the commits
- Community-filed not measured of issues opened, last 12 months
- Median time to close not measured issues closed, last 12 months
- Open backlog 67 of 188 issues ever filed
- Issues opened / month 0 · 0 communitymaintainers
- Open backlog 67
- Contributors / month 0
- Commits / month 0
- Stars 13,086
Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this
Articles
19 articles · updated Nov 4, 2026Where powersploit turns up in what others publish: how-tos, attack reports that name it, and incident write-ups. A row says why it is here and quotes where the article names it; the link goes to the publisher.
Show all 16
-
AI-Coded Malware | Analyzing Vibe-Coded AD Enumeration | Huntress
For years, defenders have relied on identifying the signatures and behaviors of off-the-shelf offensive tooling, like BloodHound, PowerSploit, or Cobalt Strike.
-
Velociraptor WSUS Exploitation, Pt. I: WSUS-Up?
…tools that have previously been misused in attacks include dual-use penetration testing frameworks, such as Cobalt Strike, Mimikatz, Metasploit, and PowerSploit, as highlighted in the Huntress 2025 Cyber Threat Report .
-
Mining off the Land: Cryptomining Enabled by Native Windows Tools
We later confirmed this by obtaining the malicious PowerShell script and discovering it used a version of Invoke-ReflectivePEInjection (from PowerSploit) to load an XMRig miner binary into PowerShell.
Libraries its release ships
What its latest release locks, checked against known advisories.None of its release's images build from a lockfile we can read.
Add the badge to your README
Maintain this project? The badge links readers straight to this page, so they can follow every release here.
Choose a badge style and copy the code →