Intrusion Detection Avoidance Payload Generator: NPS_Payload

This script generates payloads for basic intrusion detection avoidance using nps_payload. It can be deployed by copying the msbuild_nps.xml file to the remote host or hosting it on a SMB share and using a UNC path with the msbuild.exe command. The payload uses nps to execute PowerShell code without invoking powershell.exe, making it undetectable in Event ID 4688. Defenders can detect this attack by monitoring Event ID 4688 events for any invocation of msbuild.exe and checking the command line arguments for references to UNC or local files, as well as enabling PowerShell logging to monitor Event ID 4104 for encoded PowerShell code