SloppyRAT PSInline: In-Process PowerShell via CLR Hosting

Ibrahim Saud@tektrix

•updated Sep 19, 2026•0•0•2

Detects the loading of the System.Management.Automation.dll (PowerShell assembly) by processes other than standard PowerShell executable files. This behavior often indicates an attempt to execute PowerShell code from a non-standard process, potentially to bypass security controls or obfuscate malicious activity.