SloppyRAT PSInline: In-Process CLR PowerShell Execution via COM

Ibrahim Saud@tektrix

•updated Sep 19, 2026•0•0•6

This rule detects potential PowerShell script execution without spawning the standard powershell.exe process. It monitors for the loading of clr.dll and System.Management.Automation.dll into any process other than powershell.exe, which is a technique used by some malware families like SloppyRAT to execute PowerShell code directly within a compromised process memory space.