C# code can be included and executed in a PowerShell script using Add-Type. According to Microsoft:

"Add-Type compiles the specified source code and generates an in-memory assembly that contains the new .NET Framework types."


How does this work? Does this method leave any artifacts on the disk, and if so, does antivirus detect and prevent this method (provided that the compiled binary would be flagged as malicous)? Traditionally, antiviruses do not detect or prevent PowerShell malware.


Can Artifacts be found on the disk?

PowerShell compiles the assembly in memory. Therefore no artifacts will be seen on the disk since we are talking about Dynamic Memory. The only place you might find it would be in a crash log if PowerShell was terminated incorrectly.

Does an antivirus detect this method and prevent it from running?

No. This method is not inherently malicious, however, you can assemble specific libraries in powershell which would allow threat actors to run malware arbitrarily.

For example:

Threat Actors use the Invoke Expression cmdlet to run strings as a command. Theoretically, you can assemble and execute a byte array in PowerShell. Please see this stackoverflow post for an example:


This MSDN article explains the Web Client object and how to download strings: https://msdn.microsoft.com/en-us/library/system.net.webclient.downloadstring(v=vs.110).aspx you can then execute the downloaded string using IEX or Invoke-Expression.

If your question is how to STOP such activity from occurring on your network, the best thing to do is employ endpoint threat detection or start using AppLocker. I highly recommend AppLocker policies or if you have the budget Carbon Black Defense.

Advanced EndPoint Threat Detection

Additionally, you are better off getting Carbon Black Response or Red Cloak AETD to detect this activity. No AV will prevent PowerShell from running on your host. PowerShell is not malicious neither are its cmdlets or methods. However, Red Cloak and Carbon Black can detect specific commands that are being run by PowerShell using Pattern Based Indicators.

  • Powershell Constrained mode will prevent this kind of attack as well. – Daniel Grover Oct 23 '17 at 15:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.