SloppyRAT PSInline: In-Process PowerShell via CLR COM Hosting

Ibrahim Saud@tektrix

•updated Sep 19, 2026•1•0•4

Detects the loading of 'clr.dll' and 'System.Management.Automation.dll' (or related variants) by a process that is not a known PowerShell host. This behavior is indicative of a 'PSInline' execution technique, where an attacker leverages COM or direct assembly loading to execute PowerShell scripts or commands within a benign or malicious process to avoid spawning explicit powershell.exe processes.