TencShell - execute-assembly In-Memory Loader (T1620)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•2

Detects the in-memory execution of .NET assemblies from the Go implant using the extracted execute-assembly_windows.go structures. Specifically looks for 'mscoree.dll' being loaded by a process named 'setup.exe'.