PowerShell has bent over backwards from day one to avoid being a vector for malware. You can't invoke a .ps1 file from ShellExecute (that is to say, by double-

PowerShell has bent over backwards from day one to avoid being a vector for malware. You can't invoke a .ps1 file from ShellExecute (that is to say, by double-clicking it), in its default configuration Windows Server won't run an unsigned script and client won't run a script at all, and there are fine-grained settings to control execution policy and language mode across your enterprise. That's not to say it doesn't get used for malware, but in its default state you have to actually be running arbitrary code in some other language before you can jump to PowerShell. (When PowerShell was being designed, it was right after the infamous security push in Windows, and they knew that if they shipped a new scripting language you could double-click from an email, they'd be crucified for it.)