Learning Malware Analysis

1.6.1 PowerShell Command Basics

Before delving into the details of how malware uses PowerShell, let's understand how to execute PowerShell commands. You can execute a PowerShell command using the interactive PowerShell console; you can bring it up using the Windows program search feature or by typing powershell.exe in the command prompt. Once in the interactive PowerShell, you can type the command to execute it. In the following example, the Write-Host cmdlet writes the message to the console. A cmdlet (such as Write-Host) is a compiled command written in a .NET Framework language which is meant to be small and serves a single purpose. The cmdlet follows a standard Verb-Noun naming convention:

PS C:\> Write-Host "Hello world"Hello world