Assembly Loading Via CL_LoadAssembly.ps1 (c57872c7-614f-4d7f-a40d-b78c8df2d30d)
Detects calls to "LoadAssemblyFromPath" or "LoadAssemblyFromNS" that are part of the "CL_LoadAssembly.ps1" script. This can be abused to load different assemblies and bypass App locker controls.
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| System Script Proxy Execution - T1216 (f6fe9070-7a65-49ea-ae72-76292f42cebe) | Attack Pattern | Assembly Loading Via CL_LoadAssembly.ps1 (c57872c7-614f-4d7f-a40d-b78c8df2d30d) | Sigma-Rules | 1 |