bitsadmin/nopowershell

Health v2 · maintenance only

Adoption not part of the score

1060 stars · 144 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

NoPowerShell is a C# implementation of PowerShell-like commands that avoids using System.Management.Automation.dll, making execution invisible to PowerShell logging mechanisms. It can be loaded in-memory via Cobalt Strike's execute-assembly or launched as a DLL through rundll32.exe in restricted environments.

Use cases

• execute powershell-like commands without powershell logging
• run commands in-memory via cobalt strike execute-assembly
• launch a shell in restricted environments via rundll32
• use active directory cmdlets when powerpick is unavailable
• extend command functionality with a few lines of c#
• evade powershell script block logging during red team operations

When to choose

• you are performing red team engagements and need to avoid PowerShell logging
• you need familiar PowerShell or cmd.exe aliases in a restricted Windows environment
• you want an easily extensible C#-based command tool for Cobalt Strike

When to avoid

• you need full PowerShell language features such as scripting, pipelines, or modules
• you are looking for a defensive or administrative PowerShell replacement
• you work on non-Windows platforms

Facets

cli-tool · maturity active

security cli developer-tools security penetration-testing windows windows dotnet cli red-team powershell cobalt-strike offensive-security execute-assembly csharp post-exploitation command-line

Member repositories

For agents

markdown · JSON · MCP: product_card(name="bitsadmin/nopowershell")