# bitsadmin/nopowershell

PowerShell rebuilt in C# for Red Teaming purposes

Repository: https://github.com/bitsadmin/nopowershell
Canonical: https://ross.abutalabs.com/products/nopowershell
Language: C#
License: BSD-3-Clause
License Family: permissive
Topics: powershell, redteaming, cobaltstrike
Last push: 2026-02-27T23:31:33+00:00

## Health v2 (maintenance only)
Score: 59/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 69, release rhythm 23, longevity 100
- inputs: {"age_days": 2835, "days_push": 187, "days_rel": 302, "gap_med": null, "n_releases_24m": 1}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1060, forks 144 (observed 2026-08-28T04:03:25.782941+00:00)

## What it is
NoPowerShell is a C# implementation of PowerShell-like commands that avoids using System.Management.Automation.dll, making execution invisible to PowerShell logging mechanisms. It can be loaded in-memory via Cobalt Strike's execute-assembly or launched as a DLL through rundll32.exe in restricted environments.

## Use cases
- execute powershell-like commands without powershell logging
- run commands in-memory via cobalt strike execute-assembly
- launch a shell in restricted environments via rundll32
- use active directory cmdlets when powerpick is unavailable
- extend command functionality with a few lines of c#
- evade powershell script block logging during red team operations

## When to choose
- you are performing red team engagements and need to avoid PowerShell logging
- you need familiar PowerShell or cmd.exe aliases in a restricted Windows environment
- you want an easily extensible C#-based command tool for Cobalt Strike

## When to avoid
- you need full PowerShell language features such as scripting, pipelines, or modules
- you are looking for a defensive or administrative PowerShell replacement
- you work on non-Windows platforms

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, cli, developer-tools
- domain: security, penetration-testing, windows
- platform: windows, dotnet, cli
- tags: red-team, powershell, cobalt-strike, offensive-security, execute-assembly, csharp, post-exploitation, command-line

## Member repositories
- bitsadmin/nopowershell (main) score 59

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:03:25.782941+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T06:56:55.139673+00:00, confidence not recorded.
  - readme: https://github.com/bitsadmin/nopowershell (fetched 2026-08-28T04:03:25.782941+00:00, sha b85e7e7830fc)
- Data as of 2026-08-30T08:39:29.467469+00:00.