The Evolution of Offensive PowerShell Invocation

Alexander Leary updates RunDotNetDll32 to load .NET assemblies via Type.GetType instead of suspicious Assembly.LoadFile calls, executing DLL methods while dodging common detection logic.

Describes how attackers can submit phishing domains to web content filter categorization services so corporate filters whitelist the sites, improving success rates in phishing engagements.

Shows how stolen Exchange credentials can be weaponized through malicious Outlook rules that sync via Exchange and trigger a Start Application action, executing payloads without workstation access.

PowerShell plus the .NET Reflection API can invoke methods from .NET assemblies without an IDE or recompilation, e.g. to decrypt database passwords whose encryption routine lives in the code.

BOFScale runs a patched Tailscale daemon as a BOF-PE inside the implant, relaying C2 over standard WebSockets so DERP and control-plane traffic blends in behind CDNs like CloudFront and Fastly.

NetSPI demonstrates obfuscating HTML smuggling with Web Assembly, embedding payloads in Wasm so files reassemble victim-side and evade network detections that flag suspicious outbound file downloads.