.NET Loader - PowerShell Public DLL Drop (T1105)

Ibrahim Saud@tektrix

•updated Jun 22, 2026•0•0•2

Detects PowerShell downloading a packed loader DLL and writing it directly to the C:\Users\Public directory. This rule specifically looks for file creation events where the file path is within 'C:\Users\Public', the file name ends with '.dll', and the initiating process is 'powershell.exe'.