Hunting For In-Memory .NET Attacks

This blog post examines the growing use of .NET in-memory techniques—particularly Assembly.Load(byte[])—by adversaries to evade detection, citing real-world examples (DEEP PANDA, OilRig) and red-team tools; it explains why .NET is attractive to attackers, demonstrates how these techniques enable diskless payloads and application-whitelisting bypasses, and presents detection strategies including an on-demand PowerShell hunting script (Get-ClrReflection) and an eventing proof-of-concept (ClrGuard) to monitor and block CLR loading activity.