.. /UtilityFunctions.ps1
Star

Execute (DLL)

PowerShell Diagnostic Script


Paths:

Resources:
Acknowledgements:

Detection:

Execute

  1. Proxy execute Managed DLL with PowerShell

    powershell.exe -ep bypass -command "set-location -path c:\windows\diagnostics\system\networking; import-module .\UtilityFunctions.ps1; RegSnapin ..\..\..\..\temp\unsigned.dll;[Program.Class]::Main()"
    Use case
    Execute proxied payload with Microsoft signed binary
    Privileges required
    User
    Operating systems
    Windows 10 21H1 (likely other versions as well), Windows 11
    ATT&CK® technique
    T1216
    Tags
    Execute: DLL
    This LOLBAS executes Dynamic-Link Libraries (DLLs).