In-Memory .NET Assembly Load via mscoree.dll

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•4

Detects attempts to load the 'mscoree.dll' library by processes like PowerShell, setup, or main executables. This activity can indicate an in-memory .NET assembly load, often used by adversaries for stealthy execution (T1620).