AsyncRAT Process Hollowing into RegAsm.exe via Reflective .NET Load

Ethan Andrews@eandrews

•updated Jul 1, 2026•2•0•3

Detects evidence of AsyncRAT infection involving process hollowing into RegAsm.exe. The rule monitors for suspicious PowerShell activity involving specific artifacts ('cap.ps1', 'ConsoleApp1') used to perform reflective assembly loading, attempts to add Windows Defender exclusions for RegAsm.exe, and subsequent suspicious outbound network connections from RegAsm.exe to known C2 infrastructure.