Rapid .NET AppDomain create/unload cycle indicating in-memory module execution

Duo Tech@duotech

•updated Jul 6, 2026•1•0•2

This rule detects processes that rapidly create and unload .NET application domains within a 60-second window. This behavior is often associated with .NET-based in-memory code execution, where attackers use AppDomains to isolate, execute, and quickly dispose of malicious payloads to avoid detection.