The Increased use of powershell in attacks

The 10 top reasons why attackers use PowerShell 

1. It is installed by default on all new Windows computers.
2. It can execute payloads directly from memory, making it stealthy.
3. It generates few traces by default, making it difficult to find under forensic analysis.
4. It has remote access capabilities by default with encrypted traffic.
5. As a script, it is easy to obfuscate and difficult to detect with traditional security tools.
6. Defenders often overlook it when hardening their systems.
7. It can bypass application-whitelisting tools depending on the configuration.
8. Many gateway sandboxes do not handle script-based malware well.
9. It has a growing community with ready available scripts.
10. Many system administrators use and trust the framework, allowing PowerShell malware to blend in with regular administration work.

Fileless attacks

Referances:
Real full guide here!
https://www.crowdstrike.com/blog/blocking-malicious-powershell-downloads/
https://bensanchez.jp/fileless-malware-obfuscating-malware-using-powershell-scripts/
https://www.fireeye.com/blog/threat-research/2018/07/malicious-powershell-detection-via-machine-learning.html
https://www.mcafee.com/enterprise/es-es/security-awareness/ransomware/what-is-fileless-malware.html