PS2EXE is a tool that converts a PowerShell script into a Windows executable. The resulting .exe still runs the script logic, but it hides the plain-text code from a quick glance and makes the file look more like a normal program.
In cyber security, that packaging matters because attackers use it to improve delivery, reduce obvious script exposure, and sometimes bypass controls that focus on .ps1 files. It can also frustrate triage, since analysts may need to extract or unpack the executable before they can review the actual commands. Defenders look for executables that spawn PowerShell, unusual file names or metadata, and script-like behavior inside binaries. Allowing PowerShell script logging, application control, and inspection of suspicious executables helps expose this technique.


