A Windows PowerShell procedure that uses .NET Reflection.Emit to define delegates for native functions, resolves Windows API pointers, allocates private executable memory inside the current PowerShell process, copies an architecture-matched shellcode buffer, and starts a thread to run it. The cited PowerSploit implementation keeps the payload in memory during its local path; that does not establish that the script or launcher is absent from disk or telemetry.
Variant:
Execute a Local Script Path
powershell
RESTRICTED_ACCESS_BLUR_MARKER
RESTRICTED_ACCESS_BLUR_MARKER
RESTRICTED_ACCESS_BLUR_MARKER
RESTRICTED_ACCESS_BLUR_MARKER