.NET Loader - Automated Pre-Execution Tool Sweep (T1518.001)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•2

Detects a .NET loader interrogating the process list for a specific cluster of sandbox/analysis tools (apateDNS, tcpvcon, any.run, joeboxserver, Dbgview) using PowerShell before proceeding with its malicious activity. The rule triggers when PowerShell command line arguments contain at least two of the specified tools.