Microsoft's Lee Holmes on the company's recent efforts to bolster security of the PowerShell framework, which has long been a high-profile target for hackers
THE TRICKBOT MALWARE that targets bank customers. Password harvesters like Mimikatz. “Fileless malware” attacks.
Context & Ripple Effects
By mid-2017, PowerShell had become the attacker's favorite built-in tool: months earlier, researchers had documented a PowerShell Trojan that used DNS queries to receive its commands, letting malware blend into routine admin traffic. Lee Holmes' interview lands at the moment Microsoft stops treating the framework purely as an admin convenience and starts treating it as an attack surface, naming TrickBot, Mimikatz and fileless malware as the threat model driving the hardening work.
The arc matters because the problem did not end with 2017's script-block logging push — five years on, Microsoft was still patching the Follina Windows zero-day, which let state-backed hackers execute malicious PowerShell commands through Office documents.
First-order effects
- Defenders gain native telemetry and controls inside PowerShell itself — script-block logging and constrained execution raise the cost of the fileless, in-memory tradecraft Mimikatz-style operators rely on.
- Attackers who had been using PowerShell as free, signed infrastructure lose their stealth advantage and must retool or accept higher detection rates.
Second-order effects
- Malware families like TrickBot shift toward alternative living-off-the-land vectors — other trusted system binaries and scripting hosts — pushing endpoint-security vendors to broaden detection beyond any single tool.
- Enterprises gain leverage to enforce stricter PowerShell policies org-wide, since the vendor now ships the guardrails rather than leaving them to third-party agents.
Third-order effects
- Platform vendors increasingly treat built-in administrative tooling as a security boundary in its own right — logging, confinement and policy enforcement become defaults rather than opt-ins, a pattern Follina and later supply-chain incidents kept reinforcing.
- The distinction between 'malware' and 'abuse of legitimate tooling' erodes, shifting regulatory and audit expectations toward proving control over trusted-tool use, not just blocking known-bad files.
The trend: Operating-system vendors are progressively hardening their own legitimate admin and scripting tools as attackers favor fileless abuse of trusted binaries over traditional malware.