A PowerShell RAT is malware, or a loader for malware, that uses Windows PowerShell to start or stage remote-control functions. It may download a payload, decode commands, run scripts in memory, or establish a command-and-control channel without dropping an obvious executable first. Attackers like PowerShell because it is built into Windows and is often allowed in enterprise environments for administration.
This matters because it helps threats blend in with normal IT activity. A PowerShell RAT can support post-phishing intrusion chains, where a user is tricked into running a script or a malicious shortcut launches PowerShell automatically. Defenders look for suspicious script execution, encoded commands, unusual child processes from PowerShell, and network connections tied to scripting activity. Restricting PowerShell use, enabling logging, and applying application control can make these attacks easier to detect and harder to hide.