CL_LoadAssembly.ps1

PowerShell Diagnostic Script

Execute

Execute proxied payload with Microsoft signed binary

powershell.exe -ep bypass -command "set-location -path C:\Windows\diagnostics\system\Audio; import-module .\CL_LoadAssembly.ps1; LoadAssemblyFromPath ..\..\..\..\testing\fun.dll;[Program]::Fun()"

Proxy execute Managed DLL with PowerShell — MITRE: T1216 — Privileges: User