CatalogLOLBAS

LOL · Script

UtilityFunctions.ps1

1 techniqueWindowsLOLBASGPL-3.0

Execute

ExecutionWindows

Proxy execute Managed DLL with PowerShell

Use Execute proxied payload with Microsoft signed binary

powershell.exe -ep bypass -command "set-location -path c:\windows\diagnostics\system\networking; import-module .\UtilityFunctions.ps1; RegSnapin ..\..\..\..\temp\unsigned.dll;[Program.Class]::Main()"
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Execute
MITRE
T1216