Files
sigma-rules/rta/bin/Invoke-ImageLoad.ps1
T
2022-09-08 12:50:39 -04:00

27 lines
700 B
PowerShell

function Invoke-ImageLoad {
[CmdletBinding()]
param(
[Parameter(Position=0,Mandatory=$True)]
[String]
$DllPath
)
$type=@"
using System;
using System.Runtime.InteropServices;
public class ImportIt
{
public const string DLLPath = @"$DLLPath";
[DllImport(DLLPath, EntryPoint = "GetClassNameW", CharSet = CharSet.Unicode)]
public static extern int MessageBox(IntPtr hWnd, String text, String caption, uint type);
public static void Main()
{
MessageBox(new IntPtr(0), "Hello RTA!", "Hello Dialog", 0);
}
}
"@
Add-Type -TypeDefinition $type;
[ImportIt]::Main();
}