windows enabled community high v1.0.0

utilityfunctions

PowerShell Diagnostic Script Located at: C:\Windows\diagnostics\system\Networking\UtilityFunctions.ps1.

📋 Live Preview 
utilityfunctions
utilityfunctions

Sandbox: execFile · Timeout: 30s

Capabilities

security.execution.command

Contract

Outputs

process.output

Command execution output

Side effects: process_spawn

Workflow Edges

Produces

process.output

Resource Profile

ResourceValue
CPUlow
Memory16 MB
Networklow
Disk I/Olow

Examples

Proxy execute Managed DLL with PowerShell (Execute proxied payload with Microsoft signed binary)

powershell.exe -ep bypass -command "set-location -path c:\windows\diagnostics\system\networking; import-module .\UtilityFunctions.ps1; RegSnapin ..\..\..\..\temp\unsigned.dll;[Program.Class]::Main()"

Detection

TypeRule / Indicator
sigma https://github.com/SigmaHQ/sigma/blob/0.21-688-gd172b136b/rules/windows/process_creation/proc_creation_win_lolbas_utilityfunctions.yml

Documentation

utilityfunctions

utilityfunctions is a Windows LOLBin. PowerShell Diagnostic Script Located at: C:\Windows\diagnostics\system\Networking\UtilityFunctions.ps1.

References