.. / CL_LoadAssembly.ps1
Star

PowerShell Diagnostic Script


Paths:

Resources:
Acknowledgements:

Detection:

Execute

Proxy execute Managed DLL with PowerShell 
powershell.exe -ep bypass -command "set-location -path C:\Windows\diagnostics\system\Audio; import-module .\CL_LoadAssembly.ps1; LoadAssemblyFromPath ..\..\..\..\testing\fun.dll;[Program]::Fun()"
Usecase: Execute proxied payload with Microsoft signed binary
Privileges required: User
OS: Windows 10 21H1 (likely other versions as well), Windows 11
MITRE ATT&CK®: T1216