huntrule

PowerShell Assembly Loading via CL_LoadAssembly.ps1 Functions

Alerts on PowerShell command lines that call LoadAssemblyFromPath/LoadAssemblyFromNS in CL_LoadAssembly.ps1 context.

FreeReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
frack113, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-05-21
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags PowerShell process command lines that include calls to LoadAssemblyFromPath or LoadAssemblyFromNS associated with the CL_LoadAssembly.ps1 script. Attackers can use assembly loading to execute or access code from external libraries, potentially bypassing allowlisting controls such as AppLocker. It relies on process creation telemetry and matches command-line substrings indicating inline use of these functions.

Reporting behind it

Related detections9 linkedT1216 — drag to rearrange
Suspicious PowerShell Execution via SyncAppvPublishingServer LOLBIN
PowerShell Proxy Execution via SyncAppvPublishingServer (via process_creation)
Malicious Command Injection via SyncAppvPublishingServer VBS LOLBin (via process_creation)
Suspicious winrm.vbs LOLBAS Script Execution for Code Proxying
Windows: Code execution via Pester.bat invoked by PowerShell (Invoke-Pester/Get-Help)
Windows: Uncommon Child Processes Spawned by sigverif.exe
Windows: Suspicious CustomShellHost.exe execution spawned by non-Explorer parent
PowerShell: Signed UtilityFunctions.ps1 Loading Managed DLL via Proxy Execution
Windows PowerShell Script Proxy Execution via CL_mutexverifiers.ps1
PowerShell Assembly Loading via CL_LoadAssembly.ps1 Functions
Pivot detection · T1216 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.