Powershell Without Powershell – How To Bypass Application Whitelisting, Environment Restrictions & AV
ID: 21dd153f-e046-5812-9c1b-136f7444b589
STIX ID: report--21dd153f-e046-5812-9c1b-136f7444b589
Feed Name: Black Hills Infosec Blog
This blog post details a technique to bypass application whitelisting and disabled PowerShell/cmd.exe by embedding a PowerShell script into a C# program that uses the .NET Runspace API, compiling it with csc.exe (via a desktop-shortcut drag-and-drop trick), and executing it through InstallUtil.exe so the script runs without launching powershell.exe or cmd.exe; the write-up includes complete Program.cs code, compilation and execution steps using PowerUp.ps1 as an example, and usage caveats (avoid Write-Host, prefer Out-File, handle interactive prompts).
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.
