Scan report
PowerShellMafia / PowerSploit
Could an attacker exploit mistakes in this code?
No issues of this kind were found.
- High
- 0
- Medium
- 0
- Low
- 0
Sources: Bandit, Semgrep, pip-audit
Does this code look like it is trying to cause harm?
Serious issues. Review the high-severity findings before using it.
- High
- 11
- Medium
- 0
- Low
- 0
Sources: YARA, ClamAV, GuardDog, dependency checker
- Likely real
- 3
- Uncertain
- 6
- Likely noise
- 2
The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.
What we found, in plain English
This repository shows two major red flags that indicate it contains malicious code rather than just poor security practices. One finding was flagged by ClamAV with a high confidence score of 98%, which means the system found a known pattern used to execute malicious scripts on Windows machines. Another finding matched a YARA rule with a low confidence score of 36%, suggesting that while some suspicious code exists, it is not as certain as the first issue. These results are significant because they point directly to tools designed for privilege escalation and malware injection, which are dangerous for any developer working with this code. You should treat this repository as unsafe until you verify that all files have been removed or properly sanitized by a security expert who understands these specific threats.
Written by a local language model from the findings below. The risk scores come from the classifier, not from this summary.
Detections by engine
Score over time
Overall score each time this repository was scanned.
Findings
Highest severity first. Select a finding to see the code and what it means.
-
- Engine
- ClamAV · Antivirus engine
- Counts towards
- Malicious pattern
- File
- /Privesc/PowerUp.ps1
- Likely real
- Yes, 98% confidence
ClamAV detected: Win.Countermeasure.DotNetToJScript-9804890-0
-
- Engine
- ClamAV · Antivirus engine
- Counts towards
- Malicious pattern
- File
- /CodeExecution/Invoke-ReflectivePEInjection.ps1
- Likely real
- Yes, 98% confidence
ClamAV detected: Win.Trojan.PSempireInj-7013548-0
-
- Engine
- ClamAV · Antivirus engine
- Counts towards
- Malicious pattern
- File
- /Exfiltration/Invoke-CredentialInjection.ps1
- Likely real
- Yes, 98% confidence
ClamAV detected: Win.Trojan.PSempireInj-7013548-0
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /CodeExecution/Invoke-DllInjection.ps1
- Likely real
- Uncertain, 36% confidence
YARA rule matched: detect_process_injection — Windows process-injection API sequence
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /CodeExecution/Invoke-Shellcode.ps1
- Likely real
- Uncertain, 36% confidence
YARA rule matched: detect_process_injection — Windows process-injection API sequence
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /CodeExecution/Invoke-ReflectivePEInjection.ps1
- Likely real
- Uncertain, 36% confidence
YARA rule matched: detect_process_injection — Windows process-injection API sequence
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /Exfiltration/Invoke-CredentialInjection.ps1
- Likely real
- Uncertain, 36% confidence
YARA rule matched: detect_process_injection — Windows process-injection API sequence
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /Exfiltration/Invoke-NinjaCopy.ps1
- Likely real
- Uncertain, 36% confidence
YARA rule matched: detect_process_injection — Windows process-injection API sequence
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /Exfiltration/Invoke-Mimikatz.ps1
- Likely real
- Uncertain, 36% confidence
YARA rule matched: detect_process_injection — Windows process-injection API sequence
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /Persistence/Persistence.psm1
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /Privesc/PowerUp.ps1
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
No findings match these filters.