CL_LoadAssembly.ps1

PowerShell Diagnostic Script

Paths

  • C:\Windows\diagnostics\system\Audio\CL_LoadAssembly.ps1

Commands

Execute

Proxy execute Managed DLL with PowerShell

Use case: Execute proxied payload with Microsoft signed binary

Privileges: User

powershell.exe -ep bypass -command "set-location -path C:\Windows\diagnostics\system\Audio; import-module .\CL_LoadAssembly.ps1; LoadAssemblyFromPath ..\..\..\..\testing\fun.dll;[Program]::Fun()"

Detection

Resources