PowerSploit

v3.0.0PowerShellMafia (archived, still widely referenced)

A PowerShell module collection covering recon (PowerView), privilege escalation checks (PowerUp), persistence and script modification. Archived upstream but still the reference for what malicious PowerShell looks like, which is exactly why a defender wants to run it and read the resulting Script Block logs.

Category: Post-exploitation & lateral movement
Package: PowerSploit
Runs on: Windows
Commands: powersploit, invoke-allchecks, get-netuser, get-netcomputer

Module output is derived from the authored host and domain state; running it writes 4103/4104 Script Block events for the hunt.

Install it

The scripts below install the real PowerShellMafia (archived, still widely referenced) package on your own machine — read them first, and run them somewhere you are allowed to change. Inside the range, one press puts the simulated package on your next machine.

Linux installer (shell script)

install-powersploit.sh

No Linux build. Run this one on a Windows host in the range.

Windows installer (PowerShell)

Install-powersploit.ps1

On a range machine

Add it to your kit and every machine you launch comes with it.

On Linux

No Linux build. Run this one on a Windows host in the range.

On Windows

PowerShell Gallery

Allow signed modules for this session

Set-ExecutionPolicy -Scope Process -ExecutionPolicy RemoteSigned

Install PowerSploit

Install-Module -Name PowerSploit -Scope CurrentUser -Force

Load it
```
Import-Module PowerSploit
```

Check it worked

Confirm it resolves
```
where powersploit
```
Check the version
```
powersploit --version
```
The range reports 3.0.0.

Remove it

Take it off again
```
Uninstall-Module -Name PowerSploit
```

Inside the range

Tick it on the launch screen
Under PowerSploit's category on the advanced tool shelf. A lab that depends on it locks the toggle on and says why.
Or install it from a range terminal
```
winget install --id PowerSploit -e
```
The simulated package manager seeds the same binaries, config and receipt the shelf toggle does.
Everything here is simulated
No software is downloaded and nothing executes — the range answers from authored fixtures.

Labs that use PowerSploit

Pentest: Read the AD Attack GraphUse the /pentest/attack-graph view to spot the shortest path from a helpdesk account to Domain Admin, walk it end-to-end with the simulated Kerberoast/DCSync tools, and file the delegation finding.
Pentest: Purple-Team EmulationPlay both seats. Fire five ATT&CK techniques from the C2 console, check the SIEM after each one, and file a detection-gap finding for the two that produced nothing. Score is the ratio of techniques with a signal.
Pentest: Defense Evasion and EDR SidestepOn an authorized workstation, land a payload past an EDR that is watching AMSI, ETW and the usual hooked syscalls. Every step files an evidence line and a matching detection ask, so the report reads as both an attack write-up and a purple-team gap register.
Pentest: C2 Operations and TunnelingStand up a small beacon fleet in the /pentest/c2 console, run it over jittered HTTPS and a DNS fallback, stage a compressed collection and file the tunnel-and-egress finding — beacon fingerprints, jitter, callback cadence, all in the report.
Pentest: Ransomware Adversary EmulationEmulate a named ransomware crew end-to-end against the simulated estate: scheduled-task persistence, token-theft privilege escalation, WinRM lateral hop, benign fixture-swap impact, then hand the recovery team a per-stage detection-gap table linked to the RAN track.