PowerShell Native API Interop

In an authorized Windows test, PowerShell's Add-Type can compile C# source into an in-memory .NET assembly and use P/Invoke to call native Win32 APIs. The specific behavior here is Native API use (MITRE ATT&CK T1106). Map to PowerShell T1059.001 when PowerShell command or script execution itself is the adversary behavior. The harmless MessageBeep example demonstrates interop, not malicious activity.