philly.NET

AI coding assistants started as smarter autocomplete. Simpson Strong-Tie, a 6,500-person manufacturer of structural building products, is moving past that. The company is retiring GitHub Copilot and moving 200 developers and QA engineers to Claude, with spec-driven development at the center. Specs come first, and Claude works from them.

Wrap up 2026 with Philly.NET’s final meeting of the year as Jeff “csharpfritz” Fritz joins us for an evening of .NET exploration, practical demos, and a little holiday-season geekery. Jeff will lead with a tour of what’s new in .NET 11 and what it means for your development projects, then show off DayFrame, his Blazor Hybrid productivity application that brings live tiles back to life. For the finale, he’ll take Aspire into Minecraft, showing how application resources can become part of a block-built world. Bring your questions, your curiosity, and your affection for demos that take an unexpected turn.

⚠️ Microsoft requires everyone to check-in before entering their facility. You must provide your first and last name when signing up for this in-person event to be on the attendees list we submit to Microsoft.

⭐⭐⭐⭐⭐⭐

🔔🔔🔔🔔🔔🔔

philly.NET is also on:

Speaker: Max Covey

Advanced stealth tradecraft, including syscall dispatching, unmanaged memory access, and runtime evasion, is typically designed for compiled binaries. This talk explores what happens when those traditionally native capabilities are translated into a fileless runtime.

PowerShell was chosen as the target runtime because it is broadly available in Windows environments and exposes surprisingly low-level .NET and unmanaged functionality while often remaining enabled in enterprise settings.

Rather than treating PowerShell as "just" an automation tool, this research asks how far a fileless scripting runtime can be pushed toward native offensive capability development. I will walk through the technical implementation realities including AMSI, CLR behavior, modern AV/EDR visibility, and where AI-assisted workflows accelerated difficult interoperability and translation challenges.

Through a progression of working and failed implementations for a fileless process injector, attendees will see how traditionally native tradecraft evolves from standard C and ASM to WinAPI, NTAPI, direct syscalls, and indirect syscalls performed entirely within PowerShell. Techniques discussed include P/Invoke, marshalling, unmanaged invocation, shellcode loading, process injection, ntdll parsing, and syscall strategies within a fileless context.

A pre-recorded proof of concept will show the resulting framework successfully operating in a fileless execution model to perform process injection. This will be followed by a discussion of observability, detection opportunities, and defensive implications. The framework will be publicly available at the time of the talk.

For defenders, this talk highlights meaningful opportunities for telemetry, detection engineering, and defensive prioritization.

⚠️ Microsoft requires everyone to check-in before entering their facility. You must provide your first and last name when signing up for this in-person event to be on the attendees list we submit to Microsoft.

⭐⭐⭐⭐⭐⭐

🔔🔔🔔🔔🔔🔔

philly.NET is also on: