Files
sigma-rules/rta/bin/Invoke-ImageLoad.ps1
T
Mika Ayenson 1dfc8ca817 Release ER Production RTAs to DR (#2270)
(cherry picked from commit 0358ec9d9a)
2022-09-08 16:51:32 +00:00

27 lines
700 B
PowerShell

function Invoke-ImageLoad {
[CmdletBinding()]
param(
[Parameter(Position=0,Mandatory=$True)]
[String]
$DllPath
)
$type=@"
using System;
using System.Runtime.InteropServices;
public class ImportIt
{
public const string DLLPath = @"$DLLPath";
[DllImport(DLLPath, EntryPoint = "GetClassNameW", CharSet = CharSet.Unicode)]
public static extern int MessageBox(IntPtr hWnd, String text, String caption, uint type);
public static void Main()
{
MessageBox(new IntPtr(0), "Hello RTA!", "Hello Dialog", 0);
}
}
"@
Add-Type -TypeDefinition $type;
[ImportIt]::Main();
}