Assembly Loading Via CL_LoadAssembly.ps1

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•3

Detects calls to "LoadAssemblyFromPath" or "LoadAssemblyFromNS" that are part of the "CL_LoadAssembly.ps1" script. This can be abused to load different assemblies and bypass App locker controls.