PowerSploit

What it does

PowerSploit is a collection of PowerShell modules for reconnaissance, persistence, privilege escalation, and exfiltration. It was central to Windows post-exploitation and remains widely referenced (now archived).

Common use cases

• •Perform in-memory reconnaissance of a Windows host using PowerShell without touching disk.
• •Establish persistence via registry run keys, scheduled tasks, or WMI event subscriptions.
• •Escalate privileges by abusing service permissions, DLL hijacking, or token manipulation.

Key features

• •Modular design with separate modules for recon, privesc, persistence, and exfiltration.
• •All scripts load directly into memory — no binaries written to disk.
• •Includes Invoke-Mimikatz for credential extraction inside a PowerShell session.
• •Widely documented with extensive usage examples in security-assessment literature.

Source