Running PowerShell without powershell.exe

To execute PowerShell commands, you usually first start powershell.exe. But there may be situations where running PowerShell in a traditional manner is not possible or allowed.

In those cases, PowerShell can still be run by using other means, such as through Windows Script Host (WSH), WMI, .NET Framework, or more.

Using “living off the land” binaries to call assembly functions

The term LOLbin is short for living off the land binaries and was coined by malware researchers Christopher Campbell and Matt Graeber at DerbyCon 3 in 2013. In a Twitter discussion on what to call those binaries that can be abused to run malicious code, the term LOLBins came up for the first time and a (highly scientific) Twitter poll made the terms LOLBins and LOLScripts official within the community.

A LOLbin refers to legitimate, pre-installed system binaries or applications that can be abused by attackers to carry out malicious activities...