Power Without Binaries: Native Offensive Techniques in Fileless Runtimes

Speaker: Max Covey

Advanced stealth tradecraft, including syscall dispatching, unmanaged memory access, and runtime evasion, is typically designed for compiled binaries. This talk explores what happens when those traditionally native capabilities are translated into a fileless runtime.

PowerShell was chosen as the target runtime because it is broadly available in Windows environments and exposes surprisingly low-level .NET and unmanaged functionality while often remaining enabled in enterprise settings.

Rather than treating PowerShell as "just" an automation tool, this research asks how far a fileless scripting runtime can be pushed toward native offensive capability development. I will walk through the technical implementation realities including AMSI, CLR behavior, modern AV/EDR visibility, and where AI-assisted workflows accelerated difficult interoperability and translation challenges.

Through a progression of working and failed implementations for a fileless process injector, attendees will see how traditionally native tradecraft evolves from standard C and ASM to WinAPI, NTAPI, direct syscalls, and indirect syscalls performed entirely within PowerShell. Techniques discussed include P/Invoke, marshalling, unmanaged invocation, shellcode loading, process injection, ntdll parsing, and syscall strategies within a fileless context.

A pre-recorded proof of concept will show the resulting framework successfully operating in a fileless execution model to perform process injection. This will be followed by a discussion of observability, detection opportunities, and defensive implications. The framework will be publicly available at the time of the talk.

For defenders, this talk highlights meaningful opportunities for telemetry, detection engineering, and defensive prioritization.

⚠️ Microsoft requires everyone to check-in before entering their facility. You must provide your first and last name when signing up for this in-person event to be on the attendees list we submit to Microsoft.

⭐⭐⭐⭐⭐⭐

🔔🔔🔔🔔🔔🔔

philly.NET is also on:

• GitHub · phillydotnet
• YouTube · phillydotnet
• Discord · PhillyDotNet
• LinkedIn · philly.NET
• Instagram · phillydotnet
• Mastadon · phillydotnet@jawns.club
• Facebook · phillynet
• Threads · phillydotnet
• X (Twitter) · phillydotnet