New Tool Release: NPS_Payload

This report documents a technique and tool (nps_payload) that injects encoded PowerShell into an msbuild-compatible XML/CSProj file to achieve code execution via msbuild.exe, including deployment via local copy or UNC share, notes that execution avoids powershell.exe and can evade Event ID 4688, and provides detection guidance and a link to the TrustedSec GitHub repository.