A PowerShell stager is a script or component that prepares or delivers later activity. It may retrieve or launch another payload, pass commands to another process, or set up a subsequent stage. The term describes a role in an attack chain, not one specific technique or proof that a script executed successfully.
Stagers matter because they can connect an initial delivery method to later actions, while changing or short-lived scripts may evade defenses based only on file hashes. Defenders investigate them using PowerShell script-block logs, AMSI scanning where available, and context such as command lines, parent processes, and network activity. A discovered script is an investigative lead; execution evidence and surrounding telemetry are needed to determine what it did.