PoshC2 can utilize multiple methods to bypass UAC.^[1]

PoshC2 can use Invoke-TokenManipulation for manipulating tokens.^[1]

PoshC2 can use Invoke-RunAs to make tokens.^[1]

PoshC2 can enumerate local and domain user account information.^[1]

PoshC2 can enumerate local and domain user account information.^[1]

PoshC2 can use Inveigh to conduct name service poisoning for credential theft and associated relay attacks.^[1]

PoshC2 can use protocols like HTTP/HTTPS for command and control traffic.^[1]

PoshC2 contains a module for compressing data using ZIP.^[1]

PoshC2 contains a module for recursively parsing through files and directories to gather valid credit card numbers.^[1]

PoshC2 has modules for brute forcing local administrator and AD user accounts.^[1]

PoshC2 can decrypt passwords stored in the RDCMan configuration file.^[2]

PoshC2 has modules for enumerating domain trusts.^[1]

PoshC2 has the ability to persist on a system using WMI events.^[1]

PoshC2 contains modules for local privilege escalation exploits such as CVE-2016-9192 and CVE-2016-0099.^[1]

PoshC2 contains a module for exploiting SMB via EternalBlue.^[1]

PoshC2 can enumerate files on the local file system and includes a module for enumerating recently accessed files.^[1]

PoshC2 has modules for keystroke logging and capturing credentials from spoofed Outlook authentication messages.^[1]

PoshC2 can perform port scans from an infected host.^[1]

PoshC2 contains a module for taking packet captures on compromised hosts.^[1]

PoshC2 contains an implementation ofMimikatz to gather credentials from memory.^[1]

PoshC2 can useGet-PassPol to enumerate the domain password policy.^[1]

PoshC2 contains modules, such asGet-LocAdm for enumerating permission groups.^[1]

PoshC2 contains multiple modules for injecting into processes, such asInvoke-PSInject.^[1]

PoshC2 contains modules that allow for use of proxies in command and control.^[1]

PoshC2 contains modules, such asGet-ComputerInfo, for enumerating common system information.^[1]

PoshC2 can enumerate network adapter information.^[1]

PoshC2 contains an implementation ofnetstat to enumerate TCP and UDP connections.^[1]

PoshC2 can enumerate service and service permission information.^[1]

PoshC2 contains an implementation ofPsExec for remote execution.^[1]

PoshC2 contains modules for searching for passwords in local and remote files.^[1]

PoshC2 has a number of modules that leverage pass the hash for lateral movement.^[1]

PoshC2 has a number of modules that use WMI to execute tasks.^[1]

^[3][4]

Sandworm Team has used multiple publicly available tools during operations, such as PoshC2.^[5]

^[2]