This attack stems off of my Powershell Payload Excel Delivery, but it uses a really cool method for Command and Control/persistence on the box.
A walk-through can be found here: http://enigma0x3.wordpress.com/2014/01/17/command-and-control-using-powershell-and-your-favorite-website/
Credit to @obscuresec and @mattifestation for this method. Their talk about it can be found here: http://www.youtube.com/watch?v=j-r6UonEkUw