Run your Dll's Entry Point From Memory... it may sound like loading it from the disk, but we are not, we are reading our dll's bytes and running it
https://github.com/Allevon412/TeamsImplant
This project is a stealthy teams implant that proxies the urlmon.dll that teams uses compile and throw this bad boy in the teams directory as urlmon.dll and you got yourself a persistence backdoor whenever teams runs by a user or at startup.
https://github.com/r4wd3r/Suborner
net user or Windows OS user management applications (e.g. netapi32::netuseradd)