Keep That PowerShell in Memory
Since our VBA and PowerShell shellcode runners do not write to disk,
it seems safe to assume that they are fully executing from memory.
However, PowerShell and the .NET framework
leave artifacts on the hard drive that antivirus programs can identify.
In this section, we’ll investigate these artifacts and use the .NET framework
reflection technique to avoid creating them.
But first, let’s discuss how exactly these artifacts are created.