Nishang in 2026: useful, dated, and still in Kali

Nishang is the PowerShell post-exploitation toolkit Nikhil Mittal started publishing in 2012, back when “PowerShell as a malware language” was a controversial idea. It collected the techniques that defined the Living-off-the-Land era of Windows post-exploitation: in-memory execution, no binary touches disk, all the API surface a defender’s monitoring missed because PowerShell was supposed to be administrative tooling. The repo (samratashok/nishang) is barely maintained in 2026, with the last meaningful commits in early 2024, but it still ships in Kali (apt install nishang) and still gets referenced in red team training materials. The reason for the disconnect: Nishang’s role today is foundational rather than frontline.

The toolkit is worth knowing about as a reference for what techniques look like even where the stock implementations don’t survive modern defenses.

What Nishang is

#

A collection of around 100 standalone PowerShell scripts grouped by purpose, designed to be loaded into a running PowerShell session and called as functions. The organization on disk reflects the post-exploitation lifecycle:

• Gather/: enumeration and credential harvesting (Get-WLAN-Keys, Invoke-MimikatzWDigestDowngrade, Get-PassHints, Invoke-CredentialsPhish)
• Backdoors/: persistence and C2 (Add-ScrnSaveBackdoor, Invoke-ADSBackdoor, DNS_TXT_Pwnage, HTTP-Backdoor)
• Escalation/: privilege escalation (Invoke-PsUACme, Invoke-MS16-032, Invoke-MS16-014)
• Execution/: code execution helpers (Out-Word, Out-Excel, Out-CHM, Download-Execute-PS)
• Client/: client-side attack helpers (Out-Shortcut, Out-Java, Out-HTA)

The author, Nikhil Mittal, runs Altered Security , which delivers the Certified Red Team Professional (CRTP) and related Active Directory training. He spun Altered Security out from his earlier Pentester Academy work in January 2023, after Pentester Academy was acquired by INE in late 2021. His training materials still reference Nishang’s modules as canonical examples of post-exploitation primitives, which is part of why the toolkit retains an audience even as its individual scripts have lost most of their offensive utility.

What Nishang earned its reputation on

#

Three things, roughly in order of historical impact.

Module ergonomics. Each script is a self-contained PowerShell function with a usable help block, parameter validation, and reasonable defaults. Loading Invoke-PowerShellTcp into a session gives you a working reverse shell with one function call and a sensible set of arguments. The discoverability matters when you’re learning post-exploitation as a discipline, and it’s what made Nishang a teaching tool as much as an operational one.

Documented techniques. Many of Nishang’s modules were the first public, runnable implementations of techniques that had been described in conference talks. Invoke-MimikatzWDigestDowngrade flips the UseLogonCredential registry value to force WDigest to cache plaintext credentials in LSASS, which then become extractable by Mimikatz. The technique was published in research; Nishang shipped the operational form. Same pattern for the ScrnSave persistence backdoor, the DNS TXT exfiltration channel, and the various UAC bypass implementations.

Living-off-the-Land emphasis. Before the LotL framing got common, Nishang’s whole premise was that you didn’t need a custom binary on a Windows target because PowerShell was already there. That conceptual shift is now table stakes for any post-exploitation tooling and was less obvious in 2012.

Where Nishang lands in 2026

#

The honest assessment: not very many places against a modern Windows target running Defender or any major commercial EDR. Stock Nishang scripts are reliably flagged on disk and during execution. The reasons:

• AMSI signatures. Every Nishang module has been parsed, signatured, and shipped to Defender’s signature database. The string Invoke-Mimikatz triggers AMSI by itself; running an unmodified Nishang script generally produces an immediate detection.
• Script Block Logging telemetry. When PowerShell Script Block Logging is enabled (still opt-in via GPO on Windows 11 and Server 2022/2025, but commonly required by STIG and most enterprise security baselines), every Nishang function the operator loads gets logged in full, with both the function definition and the parameters at call time. Even a successful AMSI bypass doesn’t hide the post-bypass execution from this telemetry source.
• Constrained Language Mode. Where WDAC or AppLocker script enforcement is configured, PowerShell runs in CLM, which blocks the .NET reflection and Add-Type calls that most of Nishang’s interesting modules depend on. Win11 24H2 had a months-long regression where CLM enforcement was broken; that got fixed in PowerShell 7.6 in 2025.

What still works in 2026:

• Lab environments and CTFs where you control the defender posture. Nishang is fine for learning what these techniques look like end-to-end.
• Older Windows targets without modern EDR. Server 2012 R2, older Win7/8 systems that survive in industrial or healthcare environments. The Invoke-MS16-032 (Secondary Logon handle privesc, James Forshaw’s 2016 vulnerability) and Invoke-MS16-014 modules still land on unpatched legacy systems, though Windows 11 and Server 2022/2025 are unaffected (different kernel surface, long since patched).
• Reference for adaptation. The technique is in the code; the signature is what’s burned. Operators routinely take a Nishang technique, rewrite the script with renamed functions, manual string obfuscation, and AMSI bypass scaffolding, then ship the modified version under a different name.
• Inside Empire. The BC Security Empire fork (covered in the Empire post ) ships Nishang-equivalent modules as native PowerShell modules in its module library, with optional obfuscation enabled. If you reach for Nishang functionality on a real engagement, that’s the more practical delivery vehicle.

Notable modules worth knowing

#

A short tour of the modules that mattered historically and the technique each one represents. The technique survives even when the stock script doesn’t.

Get-WLAN-Keys dumps saved WiFi credentials from the Windows credential store. Useful on a workstation foothold to recover home network credentials (which users reuse on corporate accounts) and to identify potentially attacker-controllable networks the laptop has connected to in the past.

Invoke-MimikatzWDigestDowngrade sets HKLM:\System\CurrentControlSet\Control\SecurityProviders\WDigest\UseLogonCredential to 1, which forces WDigest to keep plaintext credentials in LSASS memory. After a user reauthenticates (lock/unlock, RDP reconnect), Mimikatz can extract those credentials. The technique still works on systems without Credential Guard, which on modern Windows 11 with default domain join means much less than it used to.

Add-ScrnSaveBackdoor sets the user’s screensaver registry value to point at a malicious binary or script, so when the workstation auto-locks the screensaver triggers the payload. Old technique, still occasionally useful for persistence on stations where active idle behavior would be expected anyway.

Invoke-ADSBackdoor stores a malicious script in an NTFS Alternate Data Stream of an innocuous-looking file. ADS is one of those NTFS features that persists in case studies decades after most defenders learned to scan for it. Sysinternals’ streams.exe and PowerShell’s Get-Item -Stream reveal these immediately.

DNS_TXT_Pwnage is the DNS TXT record C2 implementation. The operator encodes commands in TXT records on their own domain, the implant queries periodically, decodes and executes. Slow channel (DNS isn’t designed for throughput), but DNS is rarely blocked outbound and rarely deeply inspected.

HTTP-Backdoor is the HTTP-based C2 equivalent: the implant polls an attacker URL, the response carries commands. Default URI patterns and request shapes are signatured by every major web filter, so this needs reshaping before any use against a modern environment.

The AMSI question

#

Bypassing AMSI is the gating step for any stock Nishang use against current Windows. The state of the art has shifted enough that the techniques in Nishang’s own AMSI bypass scripts are no longer reliable.

The classic in-memory AmsiScanBuffer patch (rewrite the function prologue to return a benign result) was the standard from roughly 2018 to 2023. Defender now ships behavioral signatures that detect the in-memory patch itself via memory scans, and any blog-post-derived single-liner bypass is detected on sight.

Current patchless techniques include VEH-based hardware breakpoints to intercept AmsiScanBuffer calls without modifying memory, CLR.DLL string-table overwrites that effectively disable AMSI’s CLR integration, and AMSI Write Raid variants. None of these are stable enough across Defender updates to be relied on without research before each engagement. The practical implication is that “use Nishang on a target” in 2026 means doing AMSI bypass work first, and that work is more involved than the Nishang download.

For obfuscation, the modern tool worth knowing is Chimera (PowerShell script obfuscation specifically targeting AMSI signature defeat). Older alternatives like Invoke-Obfuscation still exist and still work against weaker AV products.

When to use Nishang vs alternatives

#

A summary of the trade-offs for someone deciding between tools:

Nishang makes sense for learning the technique catalog and for engagements against unhardened or legacy environments. It’s bad for anything against a current corporate Windows estate without significant rework.

BC Security Empire 5.x is the better delivery vehicle if you want the same techniques inside a modern C2 framework with obfuscation and operator tooling around them. Empire’s module library covers most of Nishang’s functionality plus the C2 plumbing.

PowerSploit had a similar role and is also unmaintained (last meaningful commit ~January 2021). The PowerView module specifically lives on as forks integrated into Empire, BloodHound’s ingestor, and various AD enumeration scripts.

Atomic Red Team is the test framework most relevant for modern detection work: small, deliberately detectable PowerShell snippets mapped to MITRE ATT&CK techniques, designed to validate that defensive controls catch what they claim to catch. Different tool for a different job, but worth knowing about.

Custom PowerShell modules are increasingly where serious offensive PowerShell work happens, because nothing public stays unsignatured for long. The operator who can adapt a known technique (which is what Nishang taught) is doing more useful work on an engagement than the operator who can only run a pre-built script.

For C2 framework context covering broader post-exploitation work, see Covenant (.NET-based) and Mythic (Python control plane with diverse agent ecosystem).

Where this leaves Nishang

#

Nishang is a teaching artifact at this point more than a working toolkit. Its modules taught a generation of operators what PowerShell post-exploitation looks like, established conventions that survived into Empire and beyond, and still get referenced in the certifications and training programs that Nikhil Mittal’s company produces. The scripts in the repo are reliably caught by Defender, the modern AMSI bypass story has moved past what Nishang ships, and modern AD environments with Credential Guard, CLM, and Script Block Logging close most of the original attack surface.

That said, the techniques in the code remain the canonical implementations of their respective primitives. An operator who has read through Invoke-MimikatzWDigestDowngrade understands WDigest credential caching better than one who has only run it through a framework. The repo earns its place in apt install nishang for the educational value alone, which is meaningfully more than most abandoned tools earn.