Can you show the simplest PowerShell one-liner to bypass AppLocker using this technique?
Yes, based on the analysis, the shortest PowerShell commands are: `[Reflection.Assembly]::LoadFile("C:\path\to\bypass.exe")` followed by `[namespace.class]::method()` where the method contains the payload. For example, `[aaa]::bbb()` would invoke the `bbb` method in the `aaa` class to start calc.exe. This eliminates the need to import `CL_LoadAssembly.ps1`. This approach is derived from combining the methods of bohops and Casey Smith as detailed in the original article.
AppLocker bypassone-linerPowerShellAssembly.LoadFilesimplified exploit